HEAD is now at 7da20ad fix: reject decoded controls before URL parsing strips them
