ensure Authorization field has Bearer prefix