pub(crate) fn bearer_authorized(expected: &str, header: Option<&str>) -> bool
Constant-time bearer compare. Length mismatches fail without comparing bytes.