Report vuln for apache_mod_cgi_bash_env

Now with fewer false positives! It's kinda like a check method.
I think that's even better! So, just so I get this right, do an initial request with just the marker and check for it?