Check auth headers in multiple locations

basically: check if $_SERVER['HTTP_AUTHORIZATION'] exists, if not, check if getallheaders function exists, if so, check if the Authorization header exists there.
Try and avoid mixing unrelated changes please.