Basic HTTP authentication

Hi this my code trying to make a basic http authentication. I only need guidance on what is the problem. I have highlighted the problem in my code which is the substring. Any help is appreciated. Please If you can help me finish my project.

Thank you

#include <SPI.h>
#include <Ethernet.h>
#include <WebServer.h>
#include <String.h>


byte mac[] = { 0x00, 0x09, 0x34, 0x15, 0x18, 0xEA }; //physical mac address
                                     
byte sampledata=50;            //some sample data - outputs 2 (ascii = 50 DEC)             
int ledPin1 = 2;  // LED pin 1
int ledPin2 = 3;  // LED pin 2
int ledPin3 = 4;  // LED pin 3
int ledPin4 = 5;  // LED pin 4
int ledPin5 = 6;  // LED pin 5

char m_authCredentials[51];
boolean auth_page=false;
boolean authorised = false;
unsigned char m_pushback[32];
char m_pushbackDepth;
char pc;
String user_auth = String(250);

EthernetServer server(80);
EthernetClient client;

String readString = String(32); //string for fetching data from address

boolean LEDON1 = false; //LED status flag
boolean LEDON2 = false;
boolean LEDON3 = false;
boolean LEDON4 = false;
boolean LEDON5 = false;



void push(int ch)
{
  // don't allow pushing EOF
  if (ch == -1)
    return;

  m_pushback[m_pushbackDepth++] = ch;
  // can't raise error here, so just replace last char over and over
  if (m_pushbackDepth == SIZE(m_pushback))
    m_pushbackDepth = SIZE(m_pushback) - 1;
}

bool expect(const char *str, EthernetClient aclient)
{
  char c;
  boolean auth_str = false;
  int size_of_str = strlen(str); 
  Serial.println(str);
  Serial.println(size_of_str);
  while (auth_str == false)
  {
    if ((aclient.available()) && (aclient.connected()))
    {
      Serial.print("\nClient available\n");
      user_auth="";
      while ((c = aclient.read()) != '\n')
      {
        if (user_auth.length() < 250)
        {
          //Serial.print(c);
          user_auth.concat(c);
          //Serial.println(user_auth);
        }
      }

============PROBLEM AREA============================================
      user_auth.trim();
      Serial.println("Substring");
      Serial.println(user_auth.substring(1, 14));
      if (user_auth.substring(1, 14) == str) {
        Serial.print("\nSubstring found");
        auth_str = true;
      }
======================================================================
      else
      {
        user_auth[0]=0;
      }
    }
  }
  return false;
}

void readHeader(char *value, int valueLen)
{
  int ch;
  memset(value, 0, valueLen);
  --valueLen;

  // absorb whitespace
  do
  {
    ch = client.read();
  } while (ch == ' ' || ch == '\t');

  // read rest of line
  do
  {
    if (valueLen > 1)
    {
      *value++=ch;
      --valueLen;
    }
    ch = client.read();
  } while (ch != '\r');
  push(ch);
}

bool checkCredentials(const char authCredentials[45])
{
  char basic[7] = "Basic ";
  if((0 == strncmp(m_authCredentials,basic,6)) && 
     (0 == strcmp(authCredentials, m_authCredentials + 6))) return true;
  return false;
}

void setup(){
//start Ethernet
  Ethernet.begin(mac);
  Serial.begin(9600);
  server.begin();

  // disable w5100 SPI while starting SD
  pinMode(10, OUTPUT);
  digitalWrite(10, HIGH);

//  Serial.print(F("Starting SD..."));
//  if(!SD.begin(4)) Serial.println(F("SD failed"));
//  else Serial.println(F("SD Ok"));

  Serial.print(F("Starting ethernet..."));
  if(!Ethernet.begin(mac)) Serial.println(F("Ethernet failed"));
  else Serial.println(Ethernet.localIP());
  digitalWrite(10, HIGH);
  
  // give the Ethernet shield a second to initialize:
  delay(1000);
  
//Set pin 4 to output
  pinMode(ledPin1, OUTPUT); 
  pinMode(ledPin2, OUTPUT); 
  pinMode(ledPin3, OUTPUT);
  pinMode(ledPin4, OUTPUT);
  pinMode(ledPin5, OUTPUT);
//enable serial datada print  
 
}
void loop(){
// Create a client connection
EthernetClient client = server.available();
  if (client) {
    while (client.connected()) {
   if (client.available()) {
    char c = client.read();
    //read char by char HTTP request
    if (readString.length() < 32) 
      {
        //store characters to string 
        //-----readString.append(c);
          readString.concat(c);
          pc = c;
      }  
        //output chars to serial port
//        Serial.print(c);
        //if HTTP request has ended
        if ((c == '\n')) {
          // Print on serial port what we collected
          Serial.println(readString);
          // If the user is NOT authorised then send 
          // authorisation message
          if ((authorised == false)&& (auth_page == false))
          { 
              Serial.print("\n*** Sending Page");     
              client.println("HTTP/1.1 401 Authorization Required");
              client.println("Server: HTTPd/1.0");
              client.println("WWW-Authenticate: Basic realm=\"Secure Area\"");
              client.println("Content-Type: text/html");
              client.println("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\"");
              client.println("\"http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd\">");
              client.println("<HTML>");
              client.println("<HEAD>");
              client.println("<TITLE>Error</TITLE>");
              client.println("<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=ISO-8859-1\">");
              client.println("</HEAD>");
              client.println("<BODY><H1>401 Unauthorized.</H1></BODY>");              
              client.println("</HTML>");
              client.println();
              Serial.print("\n*** Page Sent, Expect Authorisation ");
              auth_page = true;
          }
          else if((authorised == false)&& (auth_page == true))
          {
              if(expect("Authorization:", client))
              {
                Serial.println(readString);
                // User has sent username and password aG9tZTpzZWN1cml0eQ==
                readHeader(m_authCredentials,51);
                //if WEBDUINO_SERIAL_DEBUGGING > 1
                Serial.print("\n*** got Authorization: of ");
                Serial.print(m_authCredentials);
              }
          }
          else
          {
.......

You might be running out of memory. Try putting all the static html strings in the F() macro.

I don't think so but I don't know why the highlighted part is being read by my arduino. Any other ideas? is my code correct?