It is recommended that untrusted data is never used to form the
contents of the response header.

Where any untrusted source is
required to be used in the response headers, it is important to ensure
that any hazardous characters (`/r`, `/n` and potentially others) are
sanitised prior to being used.

This is especially important when
setting cookie values, redirecting, etc..