handle authorization header without auth scheme

Only `Rack::Auth::Basic` was handling this case, but it should be handled globally.
So that `Rack::Auth::Digest` and my rack-oauth2 gem will be fixed against this kind of request.
ref: https://github.com/nov/rack-oauth2/pull/38