http: protect against response splitting attacks

This patch is a back-port of 3c293ba.
Closes #4696