fn credential_accepted(header: Option<&str>, expected: &str) -> bool
Scheme-agnostic: whatever word the client puts in front, the credential after it is what is checked.