use RFC 6750 Bearer Token format for auth headers