Revalidation header blacklisting should be case-insensitive.