What is the error unsafe header "User-Agent": connection.js?

The XMLHttpRequest#setRequestHeader specifically tells that a client script must not set a User-Agent, and an attempt to establish that should be ignored. Chrome rejects the setting when the connection.js script tries to set “User-Agent” to "SFAJAX 1.0" and gives an error (as any modern browser would). But this error does not stop the script from running and is completely harmless so you can ignore it.

It was written so that the Salesforce servers could identify that this was a Salesforce AJAX Toolkit API call. This toolkit predates the requirement that if a script tries to sell, some headers might be rejected, and mostly, the browsers allow you to spoof the User-Agent string, if not all of them. Nowadays, the header is mainly ignored, but it is still in the source code. As a matter of fact, you can still see that there is support for Msxml2.XMLHTTP and Microsoft.XMLHTTP, even though the browsers that use those objects are no longer there in the Supported Browser list. If you are having a problem with the AJAX Toolkit that is not doing what you expect, this error is not the cause of your problem. This spec changed in August 2015. It is now allowed to set User-Agent in setRequestHeader, but Mozilla is the only organization to do it till now.