Add security verifications.

Add verification about:
    * the event format (UTF-8, all except :, \n and \r);
    * if the client accepts the text/event-stream type. If no, a 406
      status code is sent back and an exception is thrown.