In my recollection it was Netscape, this appers to confirm it:
https://www.jwz.org/blog/2017/09/html-email-was-that-your-fa...
https://www.jwz.org/blog/2017/09/html-email-was-that-your-fa...
jwz.org##^responseheader(set-cookie)
jwz.org##^responseheader(location)
Hopefully documenting it doesn't perpetuate the arms race.