Another one is that it's technically valid to have a request target of '*' for the HTTP OPTIONS request type. It's supposed to return general information about the whole server. You can try it out with e.g. `curl -XOPTIONS http://google.com --request-target '*'`
Nginx gives you a 400 Bad Request response, Apache does nothing, and other servers vary in whether they return a non-error code.