Apache strips down “Authorization” header

I noticed that PHP global variables PHP_AUTH_USER, PHP_AUTH_PW, HTTP_AUTHORIZATION were not set while were specified in the HTTP GET / POST.
I added:

Code:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

in ISPConfig 3 -> Website -> Options -> Apache Directives
and it seems solved.
Is that the right way?
Why was the "Authorization" removed?
Thanks.