BF: anchor introduced nginx-http-auth at the end

needed since request probably could be not a correct HTTP statement but continue with
all those to match till the end and then injected ", client: VICTIM, server..." thus allowing
injection.  We better anchor at the end then

sorry that I haven't done timely feedback on the PR