「$.ajax()」を使えば Header インジェクションを防げるのは何故か

const credentials = document.getElementById('target').dataset.credentials;
const type = 'hogefuga';
// ...
$.ajax({
  // >= 1.5
  header: {'Authorization' : type + credentials },
  // <=1.4
  beforeSend: function(xhr) {
    xhr.setRequestHeader('Authorization', type + credentials);
  },
}).done(function() {
    console.log('成功');
});

jQuery.extend( {
  // Main method
  ajax: function( url, options ) {
    // If url is an object, simulate pre-1.5 signature
    if ( typeof url === "object" ) {
      options = url;
      url = undefined;
    }

    // Create the final options object
    s = jQuery.ajaxSetup( {}, options ),

    // Check for headers option
    for ( i in s.headers ) {
      jqXHR.setRequestHeader( i, s.headers[ i ] );
    }
} );

// jQuery.extend 内

// Headers (they are sent all at once)
requestHeaders = {},
requestHeadersNames = {},

// Fake xhr
jqXHR = {
  // Caches the header
  setRequestHeader: function( name, value ) {
      if ( completed == null ) {
          name = requestHeadersNames[ name.toLowerCase() ] =
              requestHeadersNames[ name.toLowerCase() ] || name;
          requestHeaders[ name ] = value;
      }
      return this;
  },
};

// jQuery.extend 内

// Get transport
transport = inspectPrefiltersOrTransports( transports, s, options, jqXHR );

// If no transport, we auto-abort
if ( !transport ) {
  done( -1, "No Transport" );
} else {

  try {
    completed = false;
    transport.send( requestHeaders, done );
  } else {
    // ...
  }
}