Port more security tests from Katana.

Depends on https://github.com/aspnet/HttpAbstractions/pull/112