Preflight Checklist

• I have read the [Contributing Guidelines](https://github.com/electro

The current WHATWG URL parser implementation is written in C/C++ and incurs a fairly significant cost crossing the JS/C++ boundary. It should be possible to realize a significant performance improvement by porting the implementation to WASM (similar to how the https://github.com/nodejs/undici project has seen a massive performance boost out of moving llhttp parser to wasm).

If someone wanted to

npm-bcrypt package is only used in accounts-password and internally it falls back to bcryptjs which hasn't been updated in a while. So wouldn't it be better if we simply added a new npm dependency to accounts-password with bcrypt and deprecated

Describe the bug
Using xframe ALLOW-FROM throws error in console: Invalid 'X-Frame-Options' header encountered when loading 'https://api.dev.mysite.com/uploads/my-file.pdf': 'ALLOW-FROM dev.mysite.com' is not a recognized directive. The header will be ignored.

https://strapi.io/documentation/v3.x/concepts/middlewares.html#response-middlewares
instructions for xframe indicate `ALLOW-FR

While I try to change header titles by passing array of titles to options like below it does not override the headers. Instead it writes new headers first and original data with old headers again from next cell.

I am experiencing the same problem.

In addition, sheets js is mutating the header array passed in, which is not something I would ever expect.

Example:

const head