I thought I'm going crazy. Safara 18.2 (20620.1.16.11.8) sends multiple duplicates of Authorization Basic headers. Disabling "Safari Preferences -> Privacy -> Hide IP address" actually helped.