Sanitize the header value in #sendRequiredSkinExtensions (in display_macros.vm) after #getRequiredSkinExtensions and before $response.setHeader(...).
Keep the newline join inside #getRequiredSkinExtensions (needed for line-by-line filtering / duplicate removal). Only flatten CR/LF for the HTTP wire format: the client injects the value as an HTML fragment, so a space is a valid separator.