authorization parser allows spaces after commas