Part of our "all parsers need unit tests" effort, given the multiple recent CVEs that have come out of parser bugs.

While there is an auth callback test, there's no direct testing of parseHeader(). Given our experiences with fromjson(), that might mean our tests aren't covering all the cases we expect them to.