Header injection blocking