Allow fallback to HTTP_AUTHORIZATION header