use `parseAuthorizationHeader` and `getBearerToken` middlewares at userinfo endpoint