This article [1] is a really great read on some of the pitfalls you encounter due to the way duplicate headers are parsed in different browsers (skip to "Let's talk about HTTP headers" if you want to jump right into the code).

[1]: https://fasterthanli.me/articles/aiming-for-correctness-with...