* Fixes issue where XSS scripts attacks were possible via the URL

* Fix error

* Move throwing error up

* Add specs and make regex cover more xss cases

* Fixing Vulnerability A Fortify Scan finds a critical Cross-Site Scripting

* use var insted of const

- fixes #2203

* Fix #2234 

* added spacing --eslint

* added test cases

* removed unexpected cases after updating the code

* Adding tests to show config.url mutation

Because config.url is modified while processing the request
when the baseURL is set,
it is impossible to perform a retry with the provided config object.

Ref #1628

* Fixing url combining without modifying config.url

As config.url is not modified anymore during the request processing.
The request can safely be retried after it failed with the provided
config.

resolves #1628

This commit fix building url with hash map (fragment identifier) when parameters are present: they must not be added after `#`, because client cut everything after `#`

Resolves #1158

This modifies http.js to uppercase the HTTP method, similar to xhr.js, before passing the request off to the transport. This causes follow-redirects to preserve the HTTP method when automatically making a request to the next URL.

* Adding support for no_proxy env variable

* Adds support for the no_proxy environment variable commonly available
  with programs supporting the http_proxy/https_proxy environment
  variables.
* Adds tests to test the no_proxy environment variable.

* Adding documentation for the proxy env variables

* Adds documentation to README.md for the supported, conventional
  http_proxy, https_proxy, and no_proxy environment variables.

The 1223 error was fixed in IE 10. See https://blogs.msdn.microsoft.com/ieinternals/2012/03/01/internet-explorer-10-consumer-preview-minor-changes-list/

response interceptor might change the type from AxiosResponse to anything they like

- Adding information in README for socketPath when used with a proxy
- Adding an HTTP test for socketPath option

* Adding a way to disable all proxy processing

When the proxy field in configuration is === false all proxy processing is
disabled. This specifically disable the 'http_proxy' environment variable
handling.

Fixes #635
Related to #434

* Change readme wording

From review comment on PR (#691)

* Update parseHeaders to match node http behavior

Node ignores duplicate entries for certain HTTP headers.

It also always converts the `set-cookie` header into an array.

* add tests for new duplicate header handling

* clarify comment

* Fixing baseURL not working in interceptors

* add test for  modify base URL in request interceptor

* Fixing combineURLs to support an empty relativeURL

When combining the base and relative URLs, we should forego force
appending a slash to the base when the relative URL is empty.
This leads to a semantic url.

* Fixing combineURLs, allowing single slash relatives