fix #7 by allowing bearer to exist anywhere in Authorization