title: Multiple authentication schemes for HTTP 'Authorization' Header
body: <p>For our api user we need two styles of authentication:</p>
  
  <ul>
  <li>authenticate the api-user (mobile-device, partner integration)</li>
  <li>authenticate a specific "normal" user, which owns data on our side</li>
  </ul>
  
  <p>The standard challenge vs. response is handled through <code>WWW-Authenticate</code> and <code>Authorization</code> Headers. I want to reuse this.</p>
  
  <p>I have following use-case: On first level we authenticate the api-user (e.g. mobile device), for some api-actions we also need to authenticate a user (e.g. user of mobile device). So we have a special case where we need two authentications schemes "at once".</p>
  
  <p>Looking at <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html" rel="noreferrer">http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html</a> I cannot see that having two different schemes inside one 'Authorization' Header is possible.</p>
  
  <pre>
  <code>
  // I just made up delimiter ';'
  Authorization: Digest .... ; CustomXXX ...
  </code>
  </pre>
  
  <p>Am I correct, if so is there an alternative?</p>