html escape response header values

this correctly handles a case like ```Link: <http://api.test.example.org/applications?page=0&per_page=20>; rel="last"```