According to the server sent events spec, data lines are parsed like this:

> The stream must then be parsed by reading everything line by line, with a U+000D CARRIAGE RETURN U+000A LINE FEED (CRLF) character pair, a single U+000A LINE FEED (LF) character not preceded by a U+000D CARRIAGE RETURN (CR) character, a single U+000D CARRIAGE RETURN (CR) character not followed by a U+000A LINE FEED (LF) character, and the end of the file being the four ways in which a line can end.

Which means that if the data contains a CR, this will potentially allow injecting extra events.  So we should split according to the above rules.

The consequence of this is that any CRs or CRLFs in the data will become LFs when they reach the client, but I can't see any other way to implement it safely.