Peppering your description with 100 uses of the word "arbitrary" and "crafted" does not cause expected behaviour to become a security vulnerability! That's not

Peppering your description with 100 uses of the word "arbitrary" and "crafted" does not cause expected behaviour to become a security vulnerability! That's not a "crafted" location header, it's a perfectly normal location header.