Fix parsed token value with header `Authorization token=`.

Related issue: #14846

With header `Authorization: Token token=`, we get token value as `nil` instead of `token`.

The current implementation with `params.shift.last` or `param.last` assume `params` or `param` is a two-elements array. But with malformed request, they are not, so instead of `last`, we should use `[1]`

cc @simonbnrd @robin850
why did you need to add the `nonce` in this method.