This test is probably the only controversial one but I believe it's the correct approach given the header doesn't have any knowledge of what the authenticator is doing, and it reports the reason as `CredentialsMissing` as they weren't provided for a supported scheme.