In #689 we decided that it could be effectively be any https://fetch.spec.whatwg.org/#header-value. However, we don't seem to be stripping leading and trailing HTTP tab or space byte (i.e., 0x09 and 0x20) anywhere.