Handle malformed (e.g. empty, single token) Authorization headers without 500