replacement, curl only replaced the Host: header on the initial request
  and didn't replace it on the following ones. This resulted in requests with
  two Host: headers.

  Now, curl checks if the location is on the same host as the initial request
  and then continues to replace the Host: header. And when it moves to another
  host, it doesn't replace the Host: header but it also doesn't make the
  second Host: header get used in the request.

  This change is verified by the two new test cases 184 and 185.

PUTs even when told to use HTTP 1.0, which is not correct.

byte file is downloaded.

this is an attempt to prevent it from doing that. affects ipv6-enabled only.

files.

back a 530 after the password is provided, as it isn't necessary because of a
bad user name or password.