attempt to fix issue238

this one is not entirely correct as it produces a set of
"header already sent" alerts in tests (in particular, modsecurity.t,
modsecurity-response-body.t, modsecurity-proxy.t)

src/ngx_http_modsecurity_header_filter.c

@@ -525,8 +525,12 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r)
     ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
     if (r->error_page) {
         return ngx_http_next_header_filter(r);
-        }
+    }
     if (ret > 0) {
+        if (!r->header_sent && ret == NGX_HTTP_FORBIDDEN) {
+            r->err_status = ret;
+            return ngx_http_send_header(r);
+        }
         return ret;
     }