Add error handling for malformed auth headers

[reweeden]

Currently if we send an auth header without the string Bearer we'll see an error like this:

$ curl -X GET --header "Authorization: foobar" http://...
{"Code":"InternalServerError","Message":"An internal server error occurred."}

With these changes:

$ curl -X GET --header "Authorization: foobar" http://...
{"status_code":400,"error_description":"Malformed Authorization header"}

NOTE: CMR accepts an authorization header containing just the token, so it is reasonable that some users might see that and try the same approach with TEA.