Is using defvar for a non-global variable ok?
Defvar always creates a globally special variable (unless it already exists, of course).  It does not matter where you call it.

It is usually used as a toplevel form or directly inside of an eval-when.  The only reason to put it anywhere else that I can think of is the use of closures.

In all other cases, I would strongly suspect that the code does not mean what the author thinks it does.

Here, the globally special variable line is created on the first call of read-http-content.  This may lead to surprising effects if you use the name line in other places.  Don't do that.