http: ignore superfluous WWW-Authenticate headers