External-auth plugin: fix missing substitution variables

Only the first parameter of Authorization header was available as substitution variable.