diff --git a/dll/win32/wininet/dialogs.c b/dll/win32/wininet/dialogs.c
index 6f2ff8261da..913a4ceaf56 100644
--- a/dll/win32/wininet/dialogs.c
+++ b/dll/win32/wininet/dialogs.c
@@ -554,15 +554,6 @@ BOOL WINAPI InternetShowSecurityInfoByURLW(LPCWSTR url, HWND window)
    return FALSE;
 }
 
-/***********************************************************************
- *           ParseX509EncodedCertificateForListBoxEntry (@)
- */
-DWORD WINAPI ParseX509EncodedCertificateForListBoxEntry(LPBYTE cert, DWORD len, LPSTR szlistbox, LPDWORD listbox)
-{
-   FIXME("stub: %p %d %s %p\n", cert, len, debugstr_a(szlistbox), listbox);
-   return ERROR_CALL_NOT_IMPLEMENTED;
-}
-
 /***********************************************************************
  *           ShowX509EncodedCertificate (@)
  */
diff --git a/dll/win32/wininet/http.c b/dll/win32/wininet/http.c
index 05f1ba2003e..f9694ca4545 100644
--- a/dll/win32/wininet/http.c
+++ b/dll/win32/wininet/http.c
@@ -253,7 +253,7 @@ server_t *get_server(substr_t name, INTERNET_PORT port, BOOL is_https, BOOL do_c
     EnterCriticalSection(&connection_pool_cs);
 
     LIST_FOR_EACH_ENTRY(iter, &connection_pool, server_t, entry) {
-        if(iter->port == port && name.len == strlenW(iter->name) && !strncmpW(iter->name, name.str, name.len)
+        if(iter->port == port && name.len == strlenW(iter->name) && !strncmpiW(iter->name, name.str, name.len)
                 && iter->is_https == is_https) {
             server = iter;
             server_addref(server);
@@ -742,18 +742,10 @@ static void HTTP_ProcessCookies( http_request_t *request )
     int HeaderIndex;
     int numCookies = 0;
     LPHTTPHEADERW setCookieHeader;
-    WCHAR *path, *tmp;
 
     if(request->hdr.dwFlags & INTERNET_FLAG_NO_COOKIES)
         return;
 
-    path = heap_strdupW(request->path);
-    if (!path)
-        return;
-
-    tmp = strrchrW(path, '/');
-    if (tmp && tmp[1]) tmp[1] = 0;
-
     EnterCriticalSection( &request->headers_section );
 
     while((HeaderIndex = HTTP_GetCustomHeaderIndex(request, szSet_Cookie, numCookies++, FALSE)) != -1)
@@ -772,11 +764,10 @@ static void HTTP_ProcessCookies( http_request_t *request )
 
         name = substr(setCookieHeader->lpszValue, data - setCookieHeader->lpszValue);
         data++;
-        set_cookie(substrz(request->server->name), substrz(path), name, substrz(data), INTERNET_COOKIE_HTTPONLY);
+        set_cookie(substrz(request->server->name), substrz(request->path), name, substrz(data), INTERNET_COOKIE_HTTPONLY);
     }
 
     LeaveCriticalSection( &request->headers_section );
-    heap_free(path);
 }
 
 static void strip_spaces(LPWSTR start)
@@ -1725,7 +1716,7 @@ static BOOL HTTP_DomainMatches(LPCWSTR server, substr_t domain)
         return FALSE;
 
     len = strlenW(dot + 1);
-    if(len <= domain.len - 2)
+    if(len < domain.len - 2)
         return FALSE;
 
     /* The server's domain is longer than the wildcard, so it
@@ -2335,6 +2326,11 @@ static DWORD HTTPREQ_SetOption(object_header_t *hdr, DWORD option, void *buffer,
         if (!(req->session->appInfo->proxyPassword = heap_strdupW(buffer))) return ERROR_OUTOFMEMORY;
         return ERROR_SUCCESS;
 
+    case INTERNET_OPTION_HTTP_DECODING:
+        if(size != sizeof(BOOL))
+            return ERROR_INVALID_PARAMETER;
+        req->decoding = *(BOOL*)buffer;
+        return ERROR_SUCCESS;
     }
 
     return INET_SetOption(hdr, option, buffer, size);
@@ -2904,7 +2900,7 @@ static DWORD set_content_length(http_request_t *request)
         request->contentLength = ~0u;
     }
 
-    if(request->hdr.decoding) {
+    if(request->decoding) {
         int encoding_idx;
 
         static const WCHAR deflateW[] = {'d','e','f','l','a','t','e',0};
@@ -3290,7 +3286,6 @@ static DWORD HTTP_HttpOpenRequestW(http_session_t *session,
     request->hdr.htype = WH_HHTTPREQ;
     request->hdr.dwFlags = dwFlags;
     request->hdr.dwContext = dwContext;
-    request->hdr.decoding = session->hdr.decoding;
     request->contentLength = ~0u;
 
     request->netconn_stream.data_stream.vtbl = &netconn_stream_vtbl;
@@ -5798,7 +5793,6 @@ DWORD HTTP_Connect(appinfo_t *hIC, LPCWSTR lpszServerName,
     session->hdr.dwFlags = dwFlags;
     session->hdr.dwContext = dwContext;
     session->hdr.dwInternalFlags |= dwInternalFlags;
-    session->hdr.decoding = hIC->hdr.decoding;
 
     WININET_AddRef( &hIC->hdr );
     session->appInfo = hIC;
@@ -6056,112 +6050,34 @@ static LPWSTR * HTTP_InterpretHttpHeader(LPCWSTR buffer)
 
 static DWORD HTTP_ProcessHeader(http_request_t *request, LPCWSTR field, LPCWSTR value, DWORD dwModifier)
 {
-    LPHTTPHEADERW lphttpHdr;
+    LPHTTPHEADERW lphttpHdr = NULL;
     INT index;
     BOOL request_only = !!(dwModifier & HTTP_ADDHDR_FLAG_REQ);
-    DWORD res = ERROR_SUCCESS;
+    DWORD res = ERROR_HTTP_INVALID_HEADER;
 
     TRACE("--> %s: %s - 0x%08x\n", debugstr_w(field), debugstr_w(value), dwModifier);
 
     EnterCriticalSection( &request->headers_section );
 
-    index = HTTP_GetCustomHeaderIndex(request, field, 0, request_only);
+    /* REPLACE wins out over ADD */
+    if (dwModifier & HTTP_ADDHDR_FLAG_REPLACE)
+        dwModifier &= ~HTTP_ADDHDR_FLAG_ADD;
+    
+    if (dwModifier & HTTP_ADDHDR_FLAG_ADD)
+        index = -1;
+    else
+        index = HTTP_GetCustomHeaderIndex(request, field, 0, request_only);
+
     if (index >= 0)
     {
-        lphttpHdr = &request->custHeaders[index];
-
-        /* replace existing header if FLAG_REPLACE is given */
-        if (dwModifier & HTTP_ADDHDR_FLAG_REPLACE)
-        {
-            HTTP_DeleteCustomHeader( request, index );
-
-            if (value && value[0])
-            {
-                HTTPHEADERW hdr;
-
-                hdr.lpszField = (LPWSTR)field;
-                hdr.lpszValue = (LPWSTR)value;
-                hdr.wFlags = hdr.wCount = 0;
-
-                if (dwModifier & HTTP_ADDHDR_FLAG_REQ)
-                    hdr.wFlags |= HDR_ISREQUEST;
-
-                res = HTTP_InsertCustomHeader( request, &hdr );
-            }
-
-            goto out;
-        }
-
-        /* do not add new header if FLAG_ADD_IF_NEW is set */
         if (dwModifier & HTTP_ADDHDR_FLAG_ADD_IF_NEW)
         {
-            res = ERROR_HTTP_INVALID_HEADER; /* FIXME */
-            goto out;
-        }
-
-        /* handle appending to existing header */
-        if (dwModifier & COALESCEFLAGS)
-        {
-            LPWSTR lpsztmp;
-            WCHAR ch = 0;
-            INT len = 0;
-            INT origlen = strlenW(lphttpHdr->lpszValue);
-            INT valuelen = strlenW(value);
-
-            /* FIXME: Should it really clear HDR_ISREQUEST? */
-            if (dwModifier & HTTP_ADDHDR_FLAG_REQ)
-                lphttpHdr->wFlags |= HDR_ISREQUEST;
-            else
-                lphttpHdr->wFlags &= ~HDR_ISREQUEST;
-
-            if (dwModifier & HTTP_ADDHDR_FLAG_COALESCE_WITH_COMMA)
-            {
-                ch = ',';
-                lphttpHdr->wFlags |= HDR_COMMADELIMITED;
-            }
-            else if (dwModifier & HTTP_ADDHDR_FLAG_COALESCE_WITH_SEMICOLON)
-            {
-                ch = ';';
-                lphttpHdr->wFlags |= HDR_COMMADELIMITED;
-            }
-
-            len = origlen + valuelen + ((ch > 0) ? 2 : 0);
-
-            lpsztmp = heap_realloc(lphttpHdr->lpszValue, (len+1)*sizeof(WCHAR));
-            if (lpsztmp)
-            {
-                lphttpHdr->lpszValue = lpsztmp;
-                /* FIXME: Increment lphttpHdr->wCount. Perhaps lpszValue should be an array */
-                if (ch > 0)
-                {
-                    lphttpHdr->lpszValue[origlen] = ch;
-                    origlen++;
-                    lphttpHdr->lpszValue[origlen] = ' ';
-                    origlen++;
-                }
-
-                memcpy(&lphttpHdr->lpszValue[origlen], value, valuelen*sizeof(WCHAR));
-                lphttpHdr->lpszValue[len] = '\0';
-            }
-            else
-            {
-                WARN("heap_realloc (%d bytes) failed\n",len+1);
-                res = ERROR_OUTOFMEMORY;
-            }
-
-            goto out;
+            LeaveCriticalSection( &request->headers_section );
+            return ERROR_HTTP_INVALID_HEADER;
         }
+        lphttpHdr = &request->custHeaders[index];
     }
-
-    /* FIXME: What about other combinations? */
-    if ((dwModifier & ~HTTP_ADDHDR_FLAG_REQ) == HTTP_ADDHDR_FLAG_REPLACE)
-    {
-        res = ERROR_HTTP_HEADER_NOT_FOUND;
-        goto out;
-    }
-
-    /* FIXME: What if value == ""? */
-    if (value)
+    else if (value)
     {
         HTTPHEADERW hdr;
 
@@ -6172,12 +6088,89 @@ static DWORD HTTP_ProcessHeader(http_request_t *request, LPCWSTR field, LPCWSTR
         if (dwModifier & HTTP_ADDHDR_FLAG_REQ)
             hdr.wFlags |= HDR_ISREQUEST;
 
-        res = HTTP_InsertCustomHeader( request, &hdr );
-        goto out;
+        res = HTTP_InsertCustomHeader(request, &hdr);
+        LeaveCriticalSection( &request->headers_section );
+        return res;
+    }
+    /* no value to delete */
+    else
+    {
+        LeaveCriticalSection( &request->headers_section );
+        return ERROR_SUCCESS;
     }
 
-    /* FIXME: What if value == NULL? */
-out:
+    if (dwModifier & HTTP_ADDHDR_FLAG_REQ)
+	    lphttpHdr->wFlags |= HDR_ISREQUEST;
+    else
+        lphttpHdr->wFlags &= ~HDR_ISREQUEST;
+
+    if (dwModifier & HTTP_ADDHDR_FLAG_REPLACE)
+    {
+        HTTP_DeleteCustomHeader( request, index );
+
+        if (value && value[0])
+        {
+            HTTPHEADERW hdr;
+
+            hdr.lpszField = (LPWSTR)field;
+            hdr.lpszValue = (LPWSTR)value;
+            hdr.wFlags = hdr.wCount = 0;
+
+            if (dwModifier & HTTP_ADDHDR_FLAG_REQ)
+                hdr.wFlags |= HDR_ISREQUEST;
+
+            res = HTTP_InsertCustomHeader(request, &hdr);
+            LeaveCriticalSection( &request->headers_section );
+            return res;
+        }
+
+        LeaveCriticalSection( &request->headers_section );
+        return ERROR_SUCCESS;
+    }
+    else if (dwModifier & COALESCEFLAGS)
+    {
+        LPWSTR lpsztmp;
+        WCHAR ch = 0;
+        INT len = 0;
+        INT origlen = strlenW(lphttpHdr->lpszValue);
+        INT valuelen = strlenW(value);
+
+        if (dwModifier & HTTP_ADDHDR_FLAG_COALESCE_WITH_COMMA)
+        {
+            ch = ',';
+            lphttpHdr->wFlags |= HDR_COMMADELIMITED;
+        }
+        else if (dwModifier & HTTP_ADDHDR_FLAG_COALESCE_WITH_SEMICOLON)
+        {
+            ch = ';';
+            lphttpHdr->wFlags |= HDR_COMMADELIMITED;
+        }
+
+        len = origlen + valuelen + ((ch > 0) ? 2 : 0);
+
+        lpsztmp = heap_realloc(lphttpHdr->lpszValue, (len+1)*sizeof(WCHAR));
+        if (lpsztmp)
+        {
+            lphttpHdr->lpszValue = lpsztmp;
+    /* FIXME: Increment lphttpHdr->wCount. Perhaps lpszValue should be an array */
+            if (ch > 0)
+            {
+                lphttpHdr->lpszValue[origlen] = ch;
+                origlen++;
+                lphttpHdr->lpszValue[origlen] = ' ';
+                origlen++;
+            }
+
+            memcpy(&lphttpHdr->lpszValue[origlen], value, valuelen*sizeof(WCHAR));
+            lphttpHdr->lpszValue[len] = '\0';
+            res = ERROR_SUCCESS;
+        }
+        else
+        {
+            WARN("heap_realloc (%d bytes) failed\n",len+1);
+            res = ERROR_OUTOFMEMORY;
+        }
+    }
     TRACE("<-- %d\n", res);
     LeaveCriticalSection( &request->headers_section );
     return res;
diff --git a/dll/win32/wininet/internet.c b/dll/win32/wininet/internet.c
index 4cbda9beab6..c3bf2615729 100644
--- a/dll/win32/wininet/internet.c
+++ b/dll/win32/wininet/internet.c
@@ -1625,7 +1625,7 @@ BOOL WINAPI InternetCrackUrlW(const WCHAR *lpszUrl, DWORD dwUrlLength, DWORD dwF
 
     if (dwFlags & ICU_DECODE)
     {
-        WCHAR *url_tmp, *buffer;
+        WCHAR *url_tmp;
         DWORD len = dwUrlLength + 1;
         BOOL ret;
 
@@ -1634,24 +1634,9 @@ BOOL WINAPI InternetCrackUrlW(const WCHAR *lpszUrl, DWORD dwUrlLength, DWORD dwF
             SetLastError(ERROR_OUTOFMEMORY);
             return FALSE;
         }
-
-        buffer = url_tmp;
-        ret = InternetCanonicalizeUrlW(url_tmp, buffer, &len, ICU_DECODE | ICU_NO_ENCODE);
-        if (!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
-        {
-            buffer = heap_alloc(len * sizeof(WCHAR));
-            if (!buffer)
-            {
-                SetLastError(ERROR_OUTOFMEMORY);
-                heap_free(url_tmp);
-                return FALSE;
-            }
-            ret = InternetCanonicalizeUrlW(url_tmp, buffer, &len, ICU_DECODE | ICU_NO_ENCODE);
-        }
+        ret = InternetCanonicalizeUrlW(url_tmp, url_tmp, &len, ICU_DECODE | ICU_NO_ENCODE);
         if (ret)
-            ret = InternetCrackUrlW(buffer, len, dwFlags & ~ICU_DECODE, lpUC);
-
-        if (buffer != url_tmp) heap_free(buffer);
+            ret = InternetCrackUrlW(url_tmp, len, dwFlags & ~ICU_DECODE, lpUC);
         heap_free(url_tmp);
         return ret;
     }
@@ -2286,8 +2271,7 @@ static WCHAR *get_proxy_autoconfig_url(void)
     CFRelease( settings );
     return ret;
 #else
-    static int once;
-    if (!once++) FIXME( "no support on this platform\n" );
+    FIXME( "no support on this platform\n" );
     return NULL;
 #endif
 }
@@ -2837,21 +2821,10 @@ BOOL WINAPI InternetSetOptionW(HINTERNET hInternet, DWORD dwOption,
 	 FIXME("Option INTERNET_OPTION_DISABLE_AUTODIAL; STUB\n");
 	 break;
     case INTERNET_OPTION_HTTP_DECODING:
-    {
-        if (!lpwhh)
-        {
-            SetLastError(ERROR_INTERNET_INCORRECT_HANDLE_TYPE);
-            return FALSE;
-        }
-        if (!lpBuffer || dwBufferLength != sizeof(BOOL))
-        {
-            SetLastError(ERROR_INVALID_PARAMETER);
-            ret = FALSE;
-        }
-        else
-            lpwhh->decoding = *(BOOL *)lpBuffer;
+        FIXME("INTERNET_OPTION_HTTP_DECODING; STUB\n");
+        SetLastError(ERROR_INTERNET_INVALID_OPTION);
+        ret = FALSE;
         break;
-    }
     case INTERNET_OPTION_COOKIES_3RD_PARTY:
         FIXME("INTERNET_OPTION_COOKIES_3RD_PARTY; STUB\n");
         SetLastError(ERROR_INTERNET_INVALID_OPTION);
@@ -2938,12 +2911,6 @@ BOOL WINAPI InternetSetOptionW(HINTERNET hInternet, DWORD dwOption,
         ret = (res == ERROR_SUCCESS);
         break;
         }
-    case INTERNET_OPTION_SETTINGS_CHANGED:
-        FIXME("INTERNET_OPTION_SETTINGS_CHANGED; STUB\n");
-        break;
-    case INTERNET_OPTION_REFRESH:
-        FIXME("INTERNET_OPTION_REFRESH; STUB\n");
-        break;
     default:
         FIXME("Option %d STUB\n",dwOption);
         SetLastError(ERROR_INTERNET_INVALID_OPTION);
@@ -4469,6 +4436,11 @@ BOOL WINAPI InternetGetSecurityInfoByURLW(LPCWSTR lpszURL, PCCERT_CHAIN_CONTEXT
 
     TRACE("(%s %p %p)\n", debugstr_w(lpszURL), ppCertChain, pdwSecureFlags);
 
+    if (!ppCertChain && !pdwSecureFlags) {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return FALSE;
+    }
+
     url.dwHostNameLength = 1;
     res = InternetCrackUrlW(lpszURL, 0, 0, &url);
     if(!res || url.nScheme != INTERNET_SCHEME_HTTPS) {
@@ -4483,15 +4455,11 @@ BOOL WINAPI InternetGetSecurityInfoByURLW(LPCWSTR lpszURL, PCCERT_CHAIN_CONTEXT
     }
 
     if(server->cert_chain) {
-        const CERT_CHAIN_CONTEXT *chain_dup;
-
-        chain_dup = CertDuplicateCertificateChain(server->cert_chain);
-        if(chain_dup) {
-            *ppCertChain = chain_dup;
+        if(pdwSecureFlags)
             *pdwSecureFlags = server->security_flags & _SECURITY_ERROR_FLAGS_MASK;
-        }else {
+
+        if(ppCertChain && !(*ppCertChain = CertDuplicateCertificateChain(server->cert_chain)))
             res = FALSE;
-        }
     }else {
         SetLastError(ERROR_INTERNET_ITEM_NOT_FOUND);
         res = FALSE;
diff --git a/dll/win32/wininet/internet.h b/dll/win32/wininet/internet.h
index a1a6a41f1e7..23567364f40 100644
--- a/dll/win32/wininet/internet.h
+++ b/dll/win32/wininet/internet.h
@@ -357,7 +357,6 @@ struct _object_header_t
     ULONG  ErrorMask;
     DWORD  dwInternalFlags;
     LONG   refs;
-    BOOL   decoding;
     INTERNET_STATUS_CALLBACK lpfnStatusCB;
     struct list entry;
     struct list children;
@@ -454,6 +453,7 @@ typedef struct
     DWORD read_size;      /* valid data size in read_buf */
     BYTE  read_buf[READ_BUFFER_SIZE]; /* buffer for already read but not returned data */
 
+    BOOL decoding;
     data_stream_t *data_stream;
     netconn_stream_t netconn_stream;
 } http_request_t;
diff --git a/dll/win32/wininet/wininet.spec b/dll/win32/wininet/wininet.spec
index 7ef28d67778..38fd03b7701 100644
--- a/dll/win32/wininet/wininet.spec
+++ b/dll/win32/wininet/wininet.spec
@@ -216,7 +216,7 @@
 @ stdcall IsUrlCacheEntryExpiredA(str long ptr)
 @ stdcall IsUrlCacheEntryExpiredW(wstr long ptr)
 @ stdcall LoadUrlCacheContent()
-@ stdcall ParseX509EncodedCertificateForListBoxEntry(ptr long str ptr)
+@ stdcall -stub ParseX509EncodedCertificateForListBoxEntry(ptr long str ptr)
 @ stdcall PrivacyGetZonePreferenceW(long long ptr ptr ptr)
 @ stdcall PrivacySetZonePreferenceW(long long long wstr)
 @ stdcall ReadUrlCacheEntryStream(ptr long ptr ptr long)
diff --git a/media/doc/README.WINE b/media/doc/README.WINE
index 5f30683e428..09843a93df5 100644
--- a/media/doc/README.WINE
+++ b/media/doc/README.WINE
@@ -201,7 +201,7 @@ reactos/dll/win32/windowscodecsext    # Synced to WineStaging-2.9
 reactos/dll/win32/winemp3.acm         # Synced to Wine-3.0
 reactos/dll/win32/wing32              # Synced to WineStaging-2.9
 reactos/dll/win32/winhttp             # Synced to Wine-3.0
-reactos/dll/win32/wininet             # Synced to WineStaging-2.16
+reactos/dll/win32/wininet             # Synced to Wine-3.0
 reactos/dll/win32/winmm               # Forked at Wine-20050628
 reactos/dll/win32/winmm/midimap       # Forked at Wine-20050628
 reactos/dll/win32/winmm/wavemap       # Forked at Wine-20050628