[REVIEW] Fixes #111 XSS in HTTP Host header