There is also plenty of ways to confuse the WAF by simply sending multiple instances of of the relevant header and/or parameter..