HTTP Header Injection or HTTP Response Splitting is a thing.