Support oauth tokens via Authorization header