auth(): separate retrieval of bearer token from verification, so we c…

[bastiaanb]

…an verify tokens not located in the Authorization header.

[twistedstream]

Hi @bastiaanb. Thanks for the PR.

I'm curious what your use case is for this? Why wouldn't the token be sent to your Nginx server via the Authorization header as a bearer token?

[bastiaanb]

Hi @twistedstream , the use case here is fitting Auth0 into some existing third party webapps which will not set an Authorization header. So we revert to setting a cookie, even though that means CSRF threats have to be mitigated outside OAuth.
Another case would be for URI encoded tokens in GET requests, for example for protected images.
And maybe even for form encoded tokens.

[jmealo]

@twistedstream third-party health checking tools. Many http health checks don't allow for sending headers.