Per specs, forbid some request headers to be set

http://xhr.spec.whatwg.org/#the-setrequestheader()-method
http://fetch.spec.whatwg.org/#forbidden-header-name

This calls for proper cookie support !