CRLF Injection in `–proxy-header` allows extra HTTP headers (CWE-93) (hackerone.com)