Prefer apache_request_headers when reading request headers.

Apache does not pass the Authorization header through to PHP as
$_SERVER["HTTP_AUTHORIZATION"], so reading from $_SERVER is not viable
with Apache.