Comment by flightofthefox

Solution seems funky. Attackers could just omit the Content-Length header