A credential (token, username, password): a valid header value with no
leading or trailing whitespace. An HTTP header cannot carry those — the
receiving server strips them as optional whitespace — so " pass " could never
arrive as given; rejecting it beats silently trimming it into another password.
A credential (token, username, password): a valid header value with no leading or trailing whitespace. An HTTP header cannot carry those — the receiving server strips them as optional whitespace — so " pass " could never arrive as given; rejecting it beats silently trimming it into another password.