It is recommended that untrusted data is never used to form the
contents of the response header.

Where any untrusted source is required to be used in the response 
headers, it is important to ensure that any hazardous characters
(`/r`, `/n` and potentially others) are sanitised prior to being
used.

This is especially important when setting cookie values,
redirecting, etc..