On: HTTP headers we don't want

[tatersolid → organicmultiloc]

Headers which have caused production bugs or misbehaviors during my career (mostly in proxies and old IE):

Content-Encoding

Vary

Cache-Control (proxies ignoring private usually)

Content-Disposition

X-UA-Compatible

P3P

Strict-Transport-Security

X-Forwarded-For

Via

Referrer

[ovao → organicmultiloc]

Prematurely axing X-Frame-Options would expose a security risk, not a “bug”, per se.