OP only consider Authorization header if correct type