I'm thinking of a simple test with a mocked out HttpTransaction that fuzzes the response headers and content+lengs of body reads.  The test can cancel on anything funky (redirects, auth challenges, etc).  Or it can handle them, though that can get somewhat funky.