My reading is that it's supposed to provide an API that's safe to use, but might not allow to do everything technically possible within the HTTP spec.