Yes, CR LF should be used to terminate all the header lines, especially
that tricky blank line at the end. But those servers and CGI scripts
that use only LF as a terminator don't appear broken because every
client assumes LF is the terminator and CR is invisible.
So there's already an algorithm for detecting when the header ends.
Perhaps all we need to do is leave that as a hint to implementors
in the spec?