Disallow setting custom HTTP headers

By setting $token to "real_token\nEvil-Header: booom", it was possible to send a custom HTTP header to WePay servers. It's not a big deal and the servers must handle that correctly but API shouldn't support a hack like this.