Ensure request and response facades are used when firing application listeners. This is the fix for CVE-2017-5648