The validation logic checks for a prefix of W/ when it should be checking for W/". As per the spec (see here and here) this allows invalid values to pass through.