ISAPI header detection code is prone to false alarms

The check for existing headers is scanning the ALL_HTTP variable and detecting a spoof attempt on nothing but a tail match on a header name when the "safeHeaderNames" option is off. This trips wildly on headers like "o" or "st" and should be tightened up to check for the real header name, same as the "safe" code path.