Adding taint support to my HTTP client script code, and running into an interesting Q. I'm requiring URLs to be untainted, but assuming the HTTP client library properly escape values, should query parameters and headers also be taint-checked?