Handle malformed Auth headers.
Don't depend on there being a valid PATH_INFO key present.
It's better not to be clever with the port number.