Yeah.
We need to put a maximum length on this HTTP header value.
Perhaps HTTP says something about this already?