This article has moved to https://joesec.me/articles/escalating-reflected-xss-with-http-smuggling/.