GPII-1038: Remove Passport from the Resource Server

And implement the access_token header parsing ourselves