NTLM WWW-Authenticate header is not always the first one, close #736