firewall might allow invalid HTML through, even though the victim's browser converts that
HTML into "valid" HTML. An intermediary might choose to act on header X, when its
semantically equivalent header Y is what's actually processed by the client.
5) When protection mechanisms are involved, a manipulation might originally be syntactically