diff --git a/lib/http/auth.py b/lib/http/auth.py
index 68fee57827bf420b5395d3e36ec2370516e0fd04..b9a66a526039189a3c5e53a37b48dad8c04a63d5 100644
--- a/lib/http/auth.py
+++ b/lib/http/auth.py
@@ -40,7 +40,7 @@ HTTP_BASIC_AUTH = "Basic"
 HTTP_DIGEST_AUTH = "Digest"
 
 # Not exactly as described in RFC2616, section 2.2, but good enough
-_NOQUOTE = re.compile(r"^[-_a-z0-9]$", re.I)
+_NOQUOTE = re.compile(r"^[-_a-z0-9]+$", re.I)
 
 
 def _FormatAuthHeader(scheme, params):