The current hash policy code only looks at the first value of a given header. The code even has a TODO about this:

For consistency with the changes that were recently made in routing to always look at multiple values of a given header, I think we should do the same thing here.

CC @htuch