We must ensure that we get a complete header name before evaluating
a ban, so "req.http." should not be accepted.

Refs #3962