Does the W3C specify which HTTP headers an XMLHttpRequest may set? If so, have they published a document justifying these requirements with security reasons?
Is it up to the browser to restrict HTTP headers at its own discretion? If so, is there a document or collection of documents online that lists the quirks of different XHR implementations or is it necessary to find that information in the documentation for each implementation?