Preauthentication docs: HTTP headers are case insensitive