I think it mainly needs taint modeling before it's done, but at least I had the time to add tests for this.

Come to think of it, I think I saw something on about receiving HTTP headers as parameters of the request handler, which is probably handled by the code already, but would be nice to have an explicit case for.