Why not a custom HTTP header where the value is the bare token without "Bearer" prefix? I don't see the value of using specifically the Authorization header fo

Why not a custom HTTP header where the value is the bare token without "Bearer" prefix? I don't see the value of using specifically the Authorization header for machine-to-machine APIs (except to make it easier for man-in-the-middle).