Re: [whatwg/fetch] Allow range header to be set by APIs (#560)

Re-reading this, I'm not happy with:

```js
const request = new Request(event.request);
request.headers.set('accept', 'foo');
```

Now the request has the range header from `event.request`, and the modified `accept` header.

The range header will be ditched when it gets copied within `fetch()`, but it feels like privileged headers should be removed if the headers are tampered with, and the guard is `"request-no-cors"`.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/560#issuecomment-368020110