use ambiguous HTTP to circumvent security systems