Extract the JWT string from the Authorization header by removing the Bearer prefix to prevent validation failures.