Authorization header 'bearer' (lower case) is rejected #261

src/auth/prehandler.ts checks authHeader.startsWith('Bearer '). The auth-scheme is case-insensitive (RFC 7235 §2.1, RFC 6750 §2.1), so a client sending bearer <token> or BEARER <token> with a valid token gets 401 invalid_token ("must use Bearer scheme").

Repro

The same valid JWT: Authorization: Bearer <jwt> → 200, Authorization: bearer <jwt> → 401.

Suggested fix

Match the scheme case-insensitively, e.g. /^bearer +(\S+)$/i.

Found during the round-7 review of #170; also on main.

🤖 Generated with Claude Code