Hi Walter,
It's been forever since I've looked at the cgicc code but it does seem this non-compliant behavior goes back to at least 2001. RFC 2616 supersedes RFC 2068 but both require CRLF as the end of line separator. However, RFC 2068 has the following note in 19.3:
The line terminator for message-header fields is the sequence CRLF.
However, we recommend that applications, when parsing such headers,
recognize a single LF as a line terminator and ignore the leading CR.
which explains why this bug doesn't seem to affect most browsers. It should still be fixed, however.
Stephen