A field guide to the five classes of HTTP response headers you actually want to verify on every release — cache directives, security headers, redirect chains, server fingerprints, and content negotiation.