Fix client credentials extraction from Authorization header

Fixed by trimming the authorization header