dup the env hash on Header#env

This prevents external mutations from impacting the internals of the
request or the Header object.

actionpack/lib/action_dispatch/http/headers.rb

@@ -86,7 +86,7 @@ def merge!(headers_or_env)
         end
       end
 
-      def env; @req.env; end
+      def env; @req.env.dup; end
 
       private