In #689 we decided that it could be effectively be any https://un5pe99xef5vf152hgyfw29h1eja2.julianrbryant.com/#header-value. However, we don't seem to be stripping leading and trailing HTTP tab or space byte (i.e., 0x09 and 0x20) anywhere.