title: What are the valid characters in http Authorization header
body: <p>I couldn't find an easy to understand answer in the specification document. Besides the simple answer I would be glad to get a reference to the specification describing this.</p>
  
  <p>This question is a follow up for <a href="https://stackoverflow.com/questions/19497841/authorization-header-in-null-when-setting-its-value-to-an-encrypted-saml-2-token">Authorization header in null when setting its value to an Encrypted SAML 2 token</a>.</p>