Multi auth header

I've added support for multiple authorization header fields and, in doing so, strictly capturing the bearer value, which enforces the format and negates the need for the badRequest exception (capturing that state as unauthorized).