fixed to correctly sanitize the input string in the built-in HTTP server which led a number of security vulnerabilities. #30