fixed GH #478: HTTPCredentials and HTTPAuthenticationParams support multiple WWW-Authenticate headers