Again, as with WWW-Authenticate header, existing aperture instances
expect LSAT, and the protocol defines it is L402, so send both, LSAT
first, to maintain backward compatibility.
The header "Authorization: LSAT..." can be removed in the future,
when all aperture instances are upgraded.