Suricata

I have a small pb with a signature/rule:
-this rule not detect/work: (WWW uppercase and space)
alert tcp any 80 -> any any (msg:"no1"; flow:to_client,established; content:"WWW-Authenticate\: "; nocase; classtype:web-application-activity; sid:9000000; rev:1;)
-but small variant detect/work: (mix case and space)
alert tcp any 80 -> any any (msg:"ok1"; flow:to_client,established; content:"Www-Authenticate\: "; nocase; classtype:web-application-activity; sid:9000001; rev:1;)
-another small variant detect/work: (WWW uppercase without space)
alert tcp any 80 -> any any (msg:"ok2"; flow:to_client,established; content:"WWW-Authenticate\:"; nocase; classtype:web-application-activity; sid:9000002; rev:1;)

Joigned pcap with good cksum (it's a live/real trafic, not fuzzing).
Tested without any another signatures/rules + output is fast option + pattern-matcher default b2g + host-os-policy are default or linux have same pb + libhtp use default-config but apache server-config have same pb.