HAProxy rspadd or set-header
Solution 1:
The http-response commands are newer (added in 1.5), adding additional functionality and flexibility to the older rspadd/rspdel/etc commands. While they'll both work, it's probably better to stick with http-response for future-compatibility.
Solution 2:
You use them depending on what you need: add to add a new value, set to replace it. If there is sensitive data that can be injected into the headers, of course you are going to use set-header.