Per RFC 7235, the realm value can be a quoted-string. That's defined in RFC 7230 and can contain HTAB or SP and up except for the double quote, backslash, or DEL. (Double quote and backslash could be escaped by backslash, but I won't bother with implementing that until it's needed.)