1. add simple xor cipher
2. fix bug in Content-Length of fake HTTP header
   where its value should need 2 more bytes