Restrict bearer token authentication to JSON requests

Bearer tokens are for API/SDK/CLI access — they should only
authenticate JSON requests.

app/controllers/concerns/authentication.rb

@@ -56,7 +56,7 @@ module Authentication
     end
 
     def authenticate_by_bearer_token
-      if request.authorization.to_s.include?("Bearer")
+      if request.authorization.to_s.include?("Bearer") && request.format.json?
         authenticate_or_request_with_http_token do |token|
           if identity = Identity.find_by_permissable_access_token(token, method: request.method)
             Current.identity = identity

test/controllers/users_controller_test.rb

@@ -145,6 +145,26 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
     assert_response :no_content
   end
 
+  test "bearer token does not authenticate HTML requests" do
+    sign_in_as :jason
+    sign_out
+
+    bearer = { "HTTP_AUTHORIZATION" => "Bearer #{identity_access_tokens(:jasons_api_token).token}" }
+    get user_path(users(:jason)), env: bearer
+
+    assert_response :redirect
+  end
+
+  test "bearer token authenticates JSON requests" do
+    sign_in_as :jason
+    sign_out
+
+    bearer = { "HTTP_AUTHORIZATION" => "Bearer #{identity_access_tokens(:jasons_api_token).token}" }
+    get user_path(users(:jason)), env: bearer, as: :json
+
+    assert_response :success
+  end
+
   test "index avoids N+1 queries on identity" do
     sign_in_as :kevin