Ignore Authorization header schemes other than Bearer

Instead of returning a 400

E.g., OAuth 1.0's "Authorization: OAuth"