only get bearer header from http headers and ignore basic authorization header

Signed-off-by: Mickey Zhang <zenkiboy@gmail.com>