a fixed stack buffer when constructing HTTP requests. Prevents an overflow if a malicious VPN gateway sends a very long hostname/path (for redirects) or cookie list. (There is a newer release of OpenConnect which includes this fix, but also some bigger code changes, so that will wait until we are done with 5.3 release). ok aja@ jasper@