Fixed bug with reading access token from authorization header

This bug was preventing clients from specifying the access token in the HTTP authorization header (vs. specifying it as a query param).