Accessing the API with http header "Authorization" does not work

[ghost]

• Gitea version (or commit ref): 1.3.2
• Git version: 2.7.4
• Operating system: Ubuntu 16.04
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No (try.gitea.io is down)
  • Not relevant
• Log gist:

Description

Accessing the API with http header "Authorization" does not work.

curl \
  --resolve gitea.net:3000:10.0.0.112 \
  -X GET \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  'http://gitea.net:3000/api/v1/repos/devs/tmv4/keys?token=4a40ddb4190802e39825f06ec8a04a4ba3af22bf'; echo

[]

The same for access_token=.
Using Authorization header:

curl \
  --resolve gitea.net:3000:10.0.0.112 \
  -X GET \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'Authorization: 4a40ddb4190802e39825f06ec8a04a4ba3af22bf' \
  http://gitea.net:3000/api/v1/repos/devs/tmv4/keys; echo

{"message":"Only signed in user is allowed to call APIs."}

No helpfull information in Debug and Trace logs. (?)

[ghost]

Reviewing the code revealed that providing -H 'Authorization: token 4a40ddb4190802e39825f06ec8a04a4ba3af22bf seems to work. This would be something which really required some documentation, I guess.