Protect against request smuggling

[aantron]

See https://paper.seebug.org/1049/. Most of this belongs in http/af, but it should also be considered on the framework end, especially in case of no-network testing.