Added test for OWASP reported strange behaviour to confirm we are behaving in the expected way