I ended up splitting this into two separate requirements. See commit history for the chain of thought.
I think we're perfectly fine with this new requirement being a MUST because it's required to validate and reject requests based on the value of that header and the client MUST include it.
Fixes #980.
I ended up splitting this into two separate requirements. See commit history for the chain of thought.
I think we're perfectly fine with this new requirement being a MUST because it's required to validate and reject requests based on the value of that header and the client MUST include it.