cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/hg/das/das.c src/hg/das/das.c
index 80722cd20f9..4911d8b0f92 100644
--- src/hg/das/das.c
+++ src/hg/das/das.c
@@ -35,38 +35,34 @@
 #define DAS_OK                     200
 #define DAS_BAD_COMMAND            400
 #define DAS_BAD_DATA_SOURCE        401
 #define DAS_BAD_COMMAND_ARGS       402
 #define DAS_BAD_REFERENCE_OBJECT   403
 #define DAS_BAD_STYLESHEET         404
 #define DAS_COORDINATE_ERROR       405
 #define DAS_SERVER_ERROR           500
 #define DAS_UNIMPLEMENTED_FEATURE  501
 
 static void dasHead(int code, boolean justText)
 /* Write out very start of DAS header */
 {
 printf("X-DAS-Version: DAS/0.95\n");
 printf("X-DAS-Status: %d\n", code);
-if (justText)
-    printf("Content-Type:text\n");
-else
-    printf("Content-Type:text/xml\n");
 // these allow access from javascript, see http://www.w3.org/TR/cors/
 printf("Access-Control-Allow-Origin: *\n");
 printf("Access-Control-Expose-Headers: X-DAS-Version X-DAS-Status X-DAS-Capabilities\n");
-printf("\n");
+cgiPrintContentType(justText ? "text" : "text/xml");
 }
 
 static void dasHeader(int code)
 /* Write out DAS header */
 {
 dasHead(code, FALSE);
 if (code != DAS_OK)
     exit(-1);
 printf("<?xml version=\"1.0\" standalone=\"no\"?>\n");
 }
 
 static char dasStrand(char strand)
 /* convert a strand to a valid DAS strand (+,-,0) */
 {
 if ((strand == '+') || (strand == '-'))