https://github.com/jenkinsci/jenkins/blob/51c46c6cf22a57860c71c7d7236ae30f6baa6651/core/src/main/java/jenkins/security/BasicHeaderProcessor.java#L63
This should be case in-sensitive: some http clients send e.g
Authorization: basic dXNlcjpwYXNz
PR 3002