return an empty string instead of false for malformed
WWW-Authenticate headers