Return 200 if access token is given via Authorization header or parameter