url isn't sanitized in logs

Thanks to the exploit hunters that like to attack my site, I've noticed 
a few ways that a url can be included in logs unsanitized.

If the url includes a newline without carriage return (for example,
"GET /foo\nbar HTTP/1.1\r\n"), it will be passed straight through into 
the logs.

Also, if there are extra spaces before the HTTP/1.1 text or if the HTTP 
version included is not 1.x (e.g. 0.8 or 2.0), the entire HTTP request 
will be printed out to the log.

(I will try to look into these more later.)