JWT bugfix: handle bad authorization headers without prefix