Current bearer comes from header bearer: Jhb it should come from Authorize header instead (for limited time, consume both options, for clients who already implemented against buggy API)