Check Authorization header for token