I'm not sure I understand the confusion. It looks like this function is for pulling the token out of an `Authorization` header. In which case, it **is** invalid if it doesn't start with `Bearer `. That is what tells the server what kind of authentication to use (bearer token rather than basic auth). And using `Bearer` specifically is part of the OAuth spec.

The implementation is a little lax though. It's perfectly happy so long as the header is more than seven characters.