E.g. if the browser returns `de-DE` or `en-US` and we don't have those specific ones, we want to fall back to `de` and `en` respectively.
In fact, they may be of 2-8 characters in length according to [BCP 47] 2.2.1. I do not really see any reason to validate them anyway, and this way we could also support e.g. `en-US` vs `en-GB`. [BCP 47]: https://tools.ietf.org/rfc/bcp/bcp47.txt
And HTTP in charge of caching.