Fix guidance on headers and RFC6570 percent-encoding

After much debate and research, we agreed that percent-encoding
was never meant to be applied to headers.

Exactly how to handle RFC6570 and cookie parameters remains TBD.
For now, this preserves (but streamlines) the existing guidance
for cookies.