Fail with `invalid_token` if a Bearer token was provided, but was not located.