Clarify README path and header validation constraints

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

README.md

@@ -38,11 +38,13 @@ If `HYPERBROWSER_BASE_URL` is set, it must be non-empty.
 When `config` is not provided, client constructors also read `HYPERBROWSER_HEADERS`
 automatically (same as API key and base URL).
 Internal request paths are validated as relative API paths and reject fragments,
-unsafe traversal segments, backslashes, and whitespace/control characters.
+unsafe traversal segments, encoded query/fragment delimiters, backslashes, and
+whitespace/control characters.
 
 You can also pass custom headers (for tracing/correlation) either via
 `ClientConfig` or directly to the client constructor.
-Header keys/values must be strings; header names are trimmed and control characters are rejected.
+Header keys/values must be strings; header names are trimmed, must use valid HTTP
+token characters, and control characters are rejected.
 Duplicate header names are rejected after normalization (case-insensitive), e.g.
 `"X-Trace"` with `"  X-Trace  "` or `"x-trace"`.