Read access token from Authorization header