Sanitize headers more thoroughly

Remove carriage returns and null bytes for good measure.

Carriage returns were recognized in PHP’s header() function on previous
versions of PHP.