WWW-Auth header is not combined correctly