use parseAuthorizationHeader and getBearerToken at register endpoint; use AccessToken.verify in verifyClientRegistration middleware