Constant FETCH_ALLOWED_REQUEST_HEADERS 

pub const FETCH_ALLOWED_REQUEST_HEADERS: &[&str];

The request headers fetchSend allows (lowercase). A header outside this list fails the request immediately with "network: header not allowed: <name>" — the browser would silently strip or reject forbidden headers per-engine; the contract makes the denial explicit and identical on every tier.