wepay/PHP-SDK — pull request #6 by vrana (2013-05-19 06:02:02+00:00)
Title: Disallow setting custom HTTP headers

By setting $token to "real_token\nEvil-Header: booom", it was possible to send a custom HTTP header to WePay servers. It's not a big deal and the servers must handle that correctly but API shouldn't support a hack like this.