Java proxy authentication: 407 with the right password

import java.net.Authenticator;
import java.net.InetSocketAddress;
import java.net.PasswordAuthentication;
import java.net.ProxySelector;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;

public class ProxyDemo {
    public static void main(String[] args) throws Exception {
        // Java refuses Basic proxy auth for HTTPS tunnels unless this is cleared,
        // before the first request. (Or start java with -Djdk.http.auth.tunneling.disabledSchemes=)
        System.setProperty("jdk.http.auth.tunneling.disabledSchemes", "");

        String user = System.getenv("PROXY_USER") + "-country-de";
        String pass = System.getenv("PROXY_PASS");

        HttpClient client = HttpClient.newBuilder()
            .proxy(ProxySelector.of(new InetSocketAddress("via.proxies.vision", 9000)))
            .authenticator(new Authenticator() {
                @Override
                protected PasswordAuthentication getPasswordAuthentication() {
                    // Answer the proxy only, never a website asking for a login.
                    return getRequestorType() == RequestorType.PROXY
                        ? new PasswordAuthentication(user, pass.toCharArray())
                        : null;
                }
            })
            .connectTimeout(Duration.ofSeconds(30))
            .build();

        HttpRequest request = HttpRequest.newBuilder(URI.create("https://ipinfo.io/json")).build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        // A 407 here is the proxy's answer, not the website's: check the login.
        System.out.println(response.statusCode() + " " + response.body());
    }
}