protect against CRLF injection

Currently, an attacker can potentially be able to craft a request that will result in extra CRLFs in the response headers. This closes that loophole for both request and response objects.