This was failing in mobile browsers. They were unable to show the username/password popup.
I suspect that those clients only expect a header of the form www-authenticate: Basic realm=realmStr.
Where realmStr is a string with no special characters. The docs say that realmStr is any string whose character set is us-ascii. The : colon symbol is part of us-ascii(number 58). So I don't know why it would cause mobile clients to fail.
www-authenticate: Basic realm=realmStr. WhererealmStris a string with no special characters. The docs say thatrealmStris any string whose character set isus-ascii. The:colon symbol is part of us-ascii(number 58). So I don't know why it would cause mobile clients to fail.