code: protected void removeStaleAuthHeaders(WWWAuthenticateHeader responseAuthHeader) {
  		String realm = responseAuthHeader.getRealm();
  
  		ListIterator<Header> authHeaderIterator =
  			message.getHeaders(AuthorizationHeader.NAME);
  		if(authHeaderIterator.hasNext()) {
  			message.removeHeader(AuthorizationHeader.NAME);
  			while(authHeaderIterator.hasNext()) {
  				AuthorizationHeader wwwAuthHeader =
  					(AuthorizationHeader) authHeaderIterator.next();
  				if(realm != null && !realm.equalsIgnoreCase(wwwAuthHeader.getRealm())) {
  					message.addHeader(wwwAuthHeader);
  				}
  			}
  		}
  
  		authHeaderIterator =
  			message.getHeaders(ProxyAuthorizationHeader.NAME);
  		if(authHeaderIterator.hasNext()) {
  			message.removeHeader(ProxyAuthorizationHeader.NAME);
  			while(authHeaderIterator.hasNext()) {
  				ProxyAuthorizationHeader proxyAuthHeader =
  					(ProxyAuthorizationHeader) authHeaderIterator.next();
  				if(realm != null && !realm.equalsIgnoreCase(proxyAuthHeader.getRealm())) {
  					message.addHeader(proxyAuthHeader);
  				}
  			}
  		}
  	}
docs: /*
  Fix for Issue 1832 : http://code.google.com/p/mobicents/issues/detail?id=1832
  Authorization header is growing when nonce become stale, don't take into account stale headers
  in the subsequent request
  
  From RFC 2617 : stale
  A flag, indicating that the previous request from the client was
  rejected because the nonce value was stale. If stale is TRUE
  (case-insensitive), the client may wish to simply retry the request
  with a new encrypted response, without reprompting the user for a
  new username and password. The server should only set stale to TRUE
  if it receives a request for which the nonce is invalid but with a
  valid digest for that nonce (indicating that the client knows the
  correct username/password). If stale is FALSE, or anything other
  than TRUE, or the stale directive is not present, the username
  and/or password are invalid, and new values must be obtained.