oauth validator reacting on missing authorization header