Added test to check if null bytes are allowed

@markijbema 
to test the hackone example explicitly you need to parse this of course, so something like Uri.decode or something., literal %0a is no problem of course.