[exim] expansion of $header_foo:

Question: in a router, when a foo: header was added in an ACL,
is the ordering of $h_foo: specified with respect to foo: headers
present in the SMTP data?

I'm using these for passing data from ACLs to routers, and worrying
about external attack. If I add my own with :at_start: will they
always precede any attackers' ones in the expansion?

Is there some better way to do this? I'd really like some $acl_rN
variables, per-recipient rather than per-message or -connection.
Possibly I should be building a string tagged by recipient in a
$acl_mN and ${extract-ing in the routers. Headers have a slight
advantage in that I can choose to not strip them at transport time,
and maintain the communication from one exim cycle to another
where needed.
I want this communication in order to cut down on duplicated database
accesses.

Thanks,
    Jeremy