XWIKI-5155: HTTP header injection via xredirect
Fixed.

(cherry picked from commit 199e08678d5f7c86afade85c40b91075ffee5710)