Validate authentication header prior to parsing

Before attempting to parse the authentication header as if it OAuth,
raise ValueError if the header does not even begin with "OAuth ".  Also,
make the check case insensitive in accordance with RFC 5849 section
3.5.1.

References #186.
Use case-insensitive removal of scheme from header