[tptacek]

Is there? If it's a custom token type, the serverside will never break with it. The client generally wants the caller to provide the "Bearer" string as well; can it break without it?