There's still a webserver between the CGI scipt and the browser, and this one fixes up the output from the CGI script, it even changes/adds headers.

I don't take much comfort in that. Perhaps you could mention said web server and its particular configuration and the cases in which it will not mangle the headers (as I can think of at least one configuration option to prevent Apache httpd from doing so).