protected AuthenticationToken createBearerToken(String token, ServletRequest request) {
        return new BearerToken(token, request.getRemoteHost());
    }
Creates an AuthenticationToken for use during login attempt with the provided credentials in the http header.
<p/>
This implementation:
<ol><li>acquires the username and password based on the request's
{@link #getAuthzHeader(ServletRequest) authorization header} via the
{@link #getPrincipalsAndCredentials(String, ServletRequest) getPrincipalsAndCredentials} method</li>
<li>The return value of that method is converted to an <code>AuthenticationToken</code> via the
{@link #createToken(String, String, ServletRequest, ServletResponse) createToken} method</li>
<li>The created <code>AuthenticationToken</code> is returned.</li>
</ol>

@param request  incoming ServletRequest
@param response outgoing ServletResponse
@return the AuthenticationToken used to execute the login attempt
web/src/main/java/org/apache/shiro/web/filter/authc/BearerHttpAuthenticationFilter.java