$request->server() should not auto html-escape values. header() however should. Also introduce some tests for this behaviour. Thanks to nn- for catching this. PHPBB3-9716