narrow scope of auth header regex for oauth2