use downcase for all basic auth situations