Fix fetching authorization header.

In some environments HTTP_AUTHORIZATION env var is not set, so as
fallback we check raw headers.