> Lines with this should still be captured.

opp. yes it is.

> I'm also wondering whether I should change (?:(?:CRAM|DIGEST)-MD5|NTLM|OTP) to just \S+

either that or validate that this is all courier supports. \S+ seems easier