Fix malformed token handling

The `getToken()` function now safely handles malformed percent-encoded Bearer tokens by returning null instead of throwing an uncaught error. This fixes a security vulnerability (GHSA-xmf8-cvqr-rfgj) where requests with invalid token encodings (like `Authorization: Bearer %`) would crash the application.