Yes, it would mean exploding. I cannot find anything that say if the HTTP spec allows or not to have the same value for the same header. I assume this should not be a problem. But thanks for the feedback. I'll merge for now and I'll try to find a bit more info about that (as I'm doing this for ZfrCors too, it may need to be fixed everywhere).