authn: lowercase "realm" in WWW-Authenticate header