add `options.header` to Bearer permit
This seems like a common thing people do in APIs, allowing the token to be passed as a custom header like `X-Company-Token: {token}` instead of in `Authorization: Bearer {token}`, so if anyone has a need for this this is something I'd be down for.