Testing accepting access token in HTTP Authorization header