Allow custom auth headers

Update strategy.js to allow users to set a custom header (instead of "authorization") when they construct a new BearerStrategy object.