Using Special Characters
If special characters are included in the value field, they must be embedded in exactly the way the origin server embeds them. For example, the space is considered a special character in cookie values. If the origin server escapes it with %20, it must be escaped with %20 in the value field. If the origin server doesn't escape it, it should not be escaped. The problem is that browsers don't enforce escaping. How a value appears in the request header really depends on how the origin server created it.