Implement Authorization header properly

[danbarua]

Instead of this: https://github.com/jchannon/Owin.StatelessAuth/blob/master/src/Owin.StatelessAuthExample.Tests/HomeModuleTests.cs#L74

it should be

        public void AddAuthHeader(HttpClient client)
        {
            client.DefaultRequestHeaders.Authorization =
                new AuthenticationHeaderValue(
                    "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJodHRwOi8vaXNzdWVyLmNvbSIsIkF1ZGllbmNlIjoiaHR0cDovL215Y29vbHdlYnNpdGUuY29tIiwiQ2xhaW1zIjpbeyJJc3N1ZXIiOiJMT0NBTCBBVVRIT1JJVFkiLCJPcmlnaW5hbElzc3VlciI6IkxPQ0FMIEFVVEhPUklUWSIsIlByb3BlcnRpZXMiOnt9LCJTdWJqZWN0IjpudWxsLCJUeXBlIjoiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIiwiVmFsdWUiOiJBZG1pbmlzdHJhdG9yIiwiVmFsdWVUeXBlIjoiaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEjc3RyaW5nIn0seyJJc3N1ZXIiOiJMT0NBTCBBVVRIT1JJVFkiLCJPcmlnaW5hbElzc3VlciI6IkxPQ0FMIEFVVEhPUklUWSIsIlByb3BlcnRpZXMiOnt9LCJTdWJqZWN0IjpudWxsLCJUeXBlIjoiaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZSIsIlZhbHVlIjoiRnJlZCIsIlZhbHVlVHlwZSI6Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hI3N0cmluZyJ9XSwiRXhwaXJ5IjoiXC9EYXRlKDQ1NjI0MjIxNDY2MjYpXC8ifQ.SDCE1lfXmvbrkQ5rBQ_UizhdEqUDFR4HHKjiLMkmIpc");
        }

Perhaps ITokenValidator could be extended to:

interface ITokenValidator
{
  ClaimsPrincipal ValidateToken(string authType, string token);
}

[danbarua]

Consider making Bearer the default authentication scheme and allow users to override it.

[jchannon]

Yup makes sense, thought it was doing that already tbh

[danbarua]

hmm StatelessAuth doesn't give you the ability to return Digest challenges correctly
https://tools.ietf.org/html/rfc2617#section-3.5 (edited)

(╯°□°）╯︵ ┻━┻

brb, got some yaks to shave