A WWW-Authenticate response header with an invalid realm doesn't crash the browser