Header-injection security fix, without perltidy

after discussion the cabal feels this is the wrong layer to handle this problem. the PSGI spec itself rejects the kind of header with control chars, that this code is handling, so its probably better at the server layer, or possible some lint like middleware. (or even enforced by whatever is creating the response).

do not merge