OAUTH consider multiple Authorization header values