Fix #138: validate HTTP headers.