Abusing HTTP hop-by-hop Request Headers | Application Security Cheat Sheet