Properly identify the Authorization header's Realm part.

This broke authentication whenever any of the `oauth_` parameters contained the substring "realm" anywhere.