The spec says
> Return all the HTTP headers, excluding headers that are a case-insensitive
> match for Set-Cookie or Set-Cookie2, as a single string, with each header
> line separated by a U+000D CR U+000A LF pair, excluding the status line,
> and with each header name and header value separated by a U+003A COLON
> U+0020 SPACE pair.
That seems to suggest "no", but is that intentional?
Yes. Makes splitting work better. Might want to test this though, but that is not a bug in the standard.