fix #7 by allowing bearer to exist anywhere in Authorization
no reason to test and throw a different exception for invalid bearer auth format (it boils down to unauthorized, so just catch it with the failed match
Merge pull request #8 from atomantic/multi_auth_header

Multi auth header