only get bearer header from http headers and ignore basic authorization ...

Can anyone please review it see if it makes any sense? Thanks. 

It's quite common that http basic auth is enabled on web server during development. 
e.g. developers are working on integrating oauth2 into their web app on their staging while the staging has http basic auth enabled. 

In that case, the normal http basic auth header conflicts with the oauth2 bearer header.