request.authorization may be a string or an array