fix(core): document that getToken returns null for malformed authorization headers (#13467)