Hmm... I feel like something in here needs to be checking whether we're a client or a server, so we can reject the headers if they're unexpected.