After quite some work, exaproxy is now serving our producting traffic nicely, however it does not mean that once in a while we do not get some surprises !
I found the following request in our logs recently:
GET /a-page.php?many=argument&passed=here\r\n HTTP/1.0\r\n Host: changed.to.protect.the.innocent.com\r\n Connection: close\r\n \r\n Yes, you read properly, there is a new line between the URI and the procotol version, here HTTP/1.0, when RFC2616 (the document which explains how a web server and your browser should speak) clearly does not allow it.