cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/lib/cheapcgi.c src/lib/cheapcgi.c
index f586199c8eb..715d16f803a 100644
--- src/lib/cheapcgi.c
+++ src/lib/cheapcgi.c
@@ -320,30 +320,41 @@
 
 void dumpCookieList()
 /* Print out the cookie list. */
 {
 struct cgiVar *v;
 for (v=cookieList; v != NULL; v = v->next)
     printf("%s=%s (%d)\n", v->name, v->val, v->saved);
 }
 
 void useTempFile()
 /* tell cheapcgi to use temp files */
 {
 doUseTempFile = TRUE;
 }
 
+void cgiPrintContentType(char *contentType)
+/* Write the CGI response header: a Content-Type line and the blank line that
+ * ends the header.  contentType NULL means "text/html".  Header lines are not
+ * ordered, so a CGI that also sends Status, Set-Cookie, Content-Disposition or
+ * the like writes those first and calls this last to close the header. */
+{
+if (contentType == NULL)
+    contentType = "text/html";
+printf("Content-Type: %s\n\n", contentType);
+}
+
 boolean cgiIsOnWeb()
 /* Return TRUE if looks like we're being run as a CGI. 
  * You cannot use this in your own CGIs to determine if you're run from the command line, 
  * as cgiFromCommandLine() will set this parameter.*/
 {
 return getenv("REQUEST_METHOD") != NULL;
 }
 
 
 char *cgiRequestMethod()
 /* Return CGI REQUEST_METHOD (such as 'GET/POST/PUT/DELETE/HEAD') */
 {
 return getenv("REQUEST_METHOD");
 }