no reason to test and throw a different exception for invalid bearer auth format (it boils down to unauthorized, so just catch it with the failed match