Make OAuth2 accept HTTP_AUTHORIZATION header

While I'm here add APIAuthotization backend for future use.