Avoid overwriting authorization header

[cuzzlor]

What

The copySessionJwtToBearerHeader utility request handler blindly overwrites any existing Authorization header value with a Bearer {} value, if there is an auth session.

This is confusing behaviour when you explicitly set an Authorization header value on a request and it is overwritten from a session cookie.

It seems a better approach would be:

• If there is no Authorization header value, set it (from the session cookie).
• The client can then explicitly set Authorizationheader values when needed, for specific requests.