And finally.... since opts is coming from the module code... and the redirection code is modifying the options, prolly it should do a duplicate when handling the redirection, because sounds unexpected, on the exploit code, to get opts modified when calling send_request_cgi.