Revisit isolation of Bearer token

This seems error prone. Can you check the type of `Authorization` header as well? I know it will throw an unauthorized error if the length is not as expected which could be enough but just food for thought.

Maybe something like:
```go
if len(bearerToken) == 2 && strings.Contains(bearerToken[0], "Bearer") {
```

_Originally posted by @syntacticNaCl in https://github.com/jcorry/morellis/pull/33_

Inspect the current Authorization-header and bearer-token handling, then review the context from pull request #33. Confirm how the header scheme and token length are validated, and consider the work done when malformed or non-Bearer headers consistently produce the intended unauthorized response.

Written by the indexing model from the issue text.