cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/hg/hgTracks/mainMain.c src/hg/hgTracks/mainMain.c
index fce837d8279..e827e3191a6 100644
--- src/hg/hgTracks/mainMain.c
+++ src/hg/hgTracks/mainMain.c
@@ -53,31 +53,31 @@
 
 /* Push very early error handling - this is just
  * for the benefit of the cgiVarExists, which
  * somehow can't be moved effectively into doMiddle. */
 htmlPushEarlyHandlers();
 cgiSpoof(&argc, argv);
 char * link = webTimeStampedLinkToResourceOnFirstCall("HGStyle.css",TRUE); // resource file link
 if (link)                                                                  // wrapped in html
     htmlSetStyle(link);
 
 oldVars = hashNew(10);
 
 if (cgiVarExists("hgt.redirectTool"))
     {
     // user has selected one of the tools in View > In external tools: Do not plot, just redirect.
-    printf("Content-type: text/html\n\n");
+    cgiPrintContentType("text/html");
     errAbortSetDoContentType(FALSE);
     cart = cartForSession(hUserCookie(), NULL, NULL);
     extToolRedirect(cart, cgiString("hgt.redirectTool"));
     }
 else if (cfgOptionBooleanDefault("doMyVariants", FALSE) && cgiVarExists("myVarShareCmd"))
     {
     cart = cartForSession(hUserCookie(), NULL, NULL);
     myVariantsShareApiHandler(cgiString("myVarShareCmd"));
     }
 else
     {
     httpHeaders = slPairNew("Cache-Control", "no-store");
     cartHtmlShell("UCSC Genome Browser v"CGI_VERSION, doMiddle, hUserCookie(), excludeVars, oldVars);
     }