protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) {
        String authorizationHeader = getAuthzHeader(request);
        if (authorizationHeader == null || authorizationHeader.length() == 0) {
            // Create an empty authentication token since there is no
            // Authorization header.
            return createBearerToken("", request);
        }

        LOGGER.debug("Attempting to execute login with auth header");

        String[] prinCred = getPrincipalsAndCredentials(authorizationHeader, request);
        if (prinCred == null || prinCred.length < 1) {
            // Create an authentication token with an empty password,
            // since one hasn't been provided in the request.
            return createBearerToken("", request);
        }

        String token = prinCred[0] != null ? prinCred[0] : "";
        return createBearerToken(token, request);
    }
Creates an AuthenticationToken for use during login attempt with the provided credentials in the http header.
<p/>
This implementation:
<ol><li>acquires the username and password based on the request's
{@link #getAuthzHeader(ServletRequest) authorization header} via the
{@link #getPrincipalsAndCredentials(String, ServletRequest) getPrincipalsAndCredentials} method</li>
<li>The return value of that method is converted to an <code>AuthenticationToken</code> via the
{@link #createToken(String, String, ServletRequest, ServletResponse) createToken} method</li>
<li>The created <code>AuthenticationToken</code> is returned.</li>
</ol>

@param request  incoming ServletRequest
@param response outgoing ServletResponse
@return the AuthenticationToken used to execute the login attempt
web/src/main/java/org/apache/shiro/web/filter/authc/BearerHttpAuthenticationFilter.java