cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/inc/cheapcgi.h src/inc/cheapcgi.h
index 8c24bed5668..a2400f88e4c 100644
--- src/inc/cheapcgi.h
+++ src/inc/cheapcgi.h
@@ -112,30 +112,36 @@
 /* Free up resources associated with dictionary. */
 
 void cgiDictionaryFreeList(struct cgiDictionary **pList);
 /* Free up a whole list of cgiDictionaries */
 
 struct cgiDictionary *cgiDictionaryFromEncodedString(char *encodedString);
 /* Giving a this=that&this=that string,  return cgiDictionary parsed out from it. 
  * This does *not* destroy input like the lower level cgiParse functions do. */
 
 char *findCookieData(char *varName);
 /* Get the string associated with varName from the cookie string. */
 
 void dumpCookieList();
 /* Print out the cookie list. */
 
+void cgiPrintContentType(char *contentType);
+/* Write the CGI response header: a Content-Type line and the blank line that
+ * ends the header.  contentType NULL means "text/html".  Header lines are not
+ * ordered, so a CGI that also sends Status, Set-Cookie, Content-Disposition or
+ * the like writes those first and calls this last to close the header. */
+
 boolean cgiIsOnWeb();
 /* Return TRUE if looks like we're being run as a CGI. */
 
 char *cgiRequestMethod();
 /* Return CGI REQUEST_METHOD (such as 'GET/POST/PUT/DELETE/HEAD') */
 
 char *cgiRequestUri();
 /* Return CGI REQUEST_URI */
 
 char *cgiRequestContentLength();
 /* Return HTTP REQUEST CONTENT_LENGTH if available*/
 
 char *cgiScriptName();
 /* Return name of script so libs can do context-sensitive stuff. */