Not yet.
but, we think it's a configuration problem.
We are running a server with Apache 2.4 and PHP-FPM and it's appear that Authorization header can be removed if we do not allow them in apache configuration file.
the problem is related here : https://stackoverflow.com/questions/17018586/apache-2-4-php-fpm-and-authorization-headers/17490827#17490827
but, we think it's a configuration problem.
We are running a server with Apache 2.4 and PHP-FPM and it's appear that Authorization header can be removed if we do not allow them in apache configuration file.
the problem is related here : https://stackoverflow.com/questions/17018586/apache-2-4-php-fpm-and-authorization-headers/17490827#17490827
Actually i can't test solution because i can't modify apache configuration on my server.
For me, I think the solution is to put on apache configuration file this directive :
CGIPassAuth On
The directive documentation is here : https://httpd.apache.org/docs/2.4/en/mod/core.html#cgipassauth