Handle comma-separated WWW-Authenticate challenges