Spanish Button HTTP Response Splitting

[forced-request]

I think we should leverage the spanish button to provide some sort of header injection. This could work by having the server respond with Content-Language: es, where es is passed as a GET parameter.

A malicious user can inject a CRLF, essentially creating a new line in the HTTP header.