private String getJWS(final HttpServletRequest request) {
        final String bearerString = request.getHeader(AUTHORIZATION_HEADER);
        String jws = null;
        if (bearerString != null && !bearerString.isEmpty()) {
            if (bearerString.startsWith(BEARER)) {
                // This chops out 'Bearer' so we get just the token.
                jws = bearerString.substring(BEARER.length());
            } else {
                jws = bearerString;
            }
            LOGGER.debug("Found auth header in request. It looks like this: {}", jws);
        }
        return jws;
    }
<p>
Filter to avoid posts to the wrong place (e.g. the root of the app)
</p>
stroom-proxy/stroom-proxy-app/src/main/java/stroom/proxy/app/servlet/ProxySecurityFilter.java