protected boolean isLoginAttempt(String authzHeader) {
        //SHIRO-415: use English Locale:
        String authzScheme = getAuthzScheme().toLowerCase(Locale.ENGLISH);
        return authzHeader.toLowerCase(Locale.ENGLISH).startsWith(authzScheme);
    }
Default implementation that returns <code>true</code> if the specified <code>authzHeader</code>
starts with the same (case-insensitive) characters specified by the
{@link #getAuthzScheme() authzScheme}, <code>false</code> otherwise.
<p/>
That is:
<p/>
<code>String authzScheme = getAuthzScheme().toLowerCase();<br/>
return authzHeader.toLowerCase().startsWith(authzScheme);</code>

@param authzHeader the 'Authorization' header value (guaranteed to be non-null if the
                   {@link #isLoginAttempt(ServletRequest, ServletResponse)} method is not overridden).
@return <code>true</code> if the authzHeader value matches that configured as defined by
the {@link #getAuthzScheme() authzScheme}.
web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java