[1.4.x] Stripped headers containing underscores to prevent spoofing in WSGI environ.

      This is a security fix. Disclosure following shortly.

Thanks to Jedediah Smith for the report.