w3c规定，当请求的header匹配如下不安全字符时，将被终止web

  Accept-Charset
  Accept-Encoding
  Connection
  Content-Length
  Cookie
  Cookie2
  Content-Transfer-Encoding
  Date
  Expect
  Host
  Keep-Alive
  Referer
  TE
  Trailer
  Transfer-Encoding
  Upgrade
  User-Agent
  Via