Uses `ApplePass` instead of `Bearer`
Detects incorrect Authorization header scheme
Cleans up code style, adds JSHint