If we only use single-character delimiters, this is simpler
If we only use single-character delimiters, this is simpler

The RFC says whitespace in the Authorization header is optional. The
temporary-delimiter approach here was fragile anyway, and only worked by
dumb luck ('&' as the RHS, unescaped, replaced the match with itself).

TATABOX42/curlicue,decklin/curlicue