fix bug 1142213: add validation inside redirectRequest() to avoid HTTP response splitting attack