PASS Ensure fetch() rejects null bytes in headers