fn credential_accepted(header: Option<&str>, expected: &str) -> bool
Exactly Bearer <token>: case-sensitive, one space, no other scheme.
Bearer <token>