Bug fix: Replace header when sending first one of each header

[akrabat]

When we call header() to send the headers in the Response, set the
replace parameter to true for the first of that header name and then
set it to false.

Don't do this if the header is Set-Cookie so we don't break sessions.

Fixes #2282
Fixes #2246

[coveralls]

Coverage increased (+0.7%) to 97.803% when pulling b504149 on akrabat:override-previously-set-headers into 2be185b on slimphp:3.x.

[ncou]

Hi,

just my 2 cents opinion, but i believe this modification could break some applications who use multiple header. I think for example to the header Content-Security-Policy you could use multiple headers with cumulative policies. With this modification only the first header will be sent. But this case is probably rare...

Keep up the good work.

[damianopetrungaro]

wdyt about using a dataProvider and trying to pass the test using "strange" values too?

[akrabat]

@ncou That's not what this patch does. It will allow multiple Content-Security-Policy headers if you add them to the Request object.

This patch replaces headers set by header() if the same header name is used in a header in the Request object.

[ncou]

hummm i think i am starting to understand (or perhaps not :)). In fact this patch will replace (one time) the header if it's already present in the header() list. To sumup it will overwrite the possible headers added by the server (like for example the "Cache-Control" header). And for the Set-Cookie it will do an exception and not replace the first occurrence, because it could be added by the server (i suppose it's to handle the case with the session cookies).
Am i right ?

[akrabat]

@ncou pretty much, yes.

[ncou]

thank you it's more clear. 👍