that's likely because it's how arrays are working by definition and there is no magic making superglobals behave different

php > $x=['a'=>1, 'A'=>2]; print_r($x);
Array
(
    [a] => 1
    [A] => 2
)

does the header not show up at all or is your code naive and only checks for HTTP_AUTHORIZATION in uppercase form?

additionally headers in HTTP2 are lowercase by definition as you can see below and i doubt that only applies to response-headers (that's a proxy and "x-response-time" from the backend for sure comes as "X-Response-Time"

HTTP/2 200
date: Mon, 29 Apr 2019 14:33:56 GMT
strict-transport-security: max-age=31536000
content-security-policy: script-src 'self' 'unsafe-inline' 'unsafe-eval';
x-frame-options: SAMEORIGIN
etag: 68fefde8d07528f48429f3f96ca70680
cache-control: private
last-modified: Mon, 28 Nov 2016 16:55:29 GMT
vary: Accept-Encoding,User-Agent
x-content-type-options: nosniff
x-response-time: D=5403 us
content-type: text/html; charset=ISO-8859-1
age: 0

Which SAPI are you using? Are PHP_AUTH_USER and PHP_AUTH_PW set?

The code checks for $_SERVER['HTTP_AUTHORIZATION'] only, but it makes no sense for me to check for $_SERVER['HTTP_aUTHORIZATION'] seeing as the only letter that has changed is `A`, all http headers come in all uppercase when recognized and prefixed with `HTTP_` in the $_SERVER var, so I don't think it's script problem.