Skip over authorization headers that aren't strings.

This fixes a bug where JavaScript extensions, in particular functions,
to the base Object type may be enumerated over and used as a header field.