Per its spec it is ignored when received over plain HTTP, so it only matters on HTTPS responses.