http auth: support for multiple challenges

tested here: http://greenbytes.de/tech/tc/httpauth/