If a header contains a newline, don't output it

Fixes a vulnerability where an attacker uses the value of a header (e.g. the target of a redirect) to insert their own headers.