HTTP Digest auth uses wrong request method for PUT, DELETE

Browsers do not support the PUT or DELETE methods, so the _method parameter is used in forms to simulate these. The browser submits the form using POST.

The problem is that the MethodOverride class replaces REQUEST_METHOD in the environment with the intended one. When the browser builds the HTTP_AUTHORIZATION header for HTTP Digest authentication, it does so knowing it will submit using POST. Validation fails, however, because Rails is using PUT or DELETE instead.

HTTP Digest authentication should first check for the presence of rack.methodoverride.original_method in the environment and use that before using REQUEST_METHOD.