check for scheme explicitly on req.authorization object