Shifting more parameters than actually exist causes dash to quit running the script with an error. It is not clear to me that POSIX requires this: http://pubs.opengroup.org/onlinepubs/009695399/utilities/shift.html But maybe it is correct in some nitpicky sense (bash does not care).
Useful if you're posting, e.g., JSON data with -H "Content-Type: application/json". We *could* try to parse that out of the options as well, but it would be considerably messier than the concessions we made for -X and -d.
The RFC says whitespace in the Authorization header is optional. The temporary-delimiter approach here was fragile anyway, and only worked by dumb luck ('&' as the RHS, unescaped, replaced the match with itself).
Names should look like they look in the official API documentation. And there should be one obviously correct way to specify params, now that we can encode them properly.
…tarlet Version 1 was only deprecated, what, months ago? And HTTP more recently.