http request smuggling vulnerability fix