@Override
public void evaluateRequest(HttpServerRequest request) throws HttpAuthenticationException {
    // Read token from authorization header
    List<String> authorizationValues = request.getRequestHeaderValues(HttpConstants.AUTHORIZATION);
    // Fallback: read token from cookies, if no authorization-header present
    if (authorizationValues == null || authorizationValues.isEmpty()) {
        List<HttpServerCookie> cookies = request.getCookies(); // Cookie handling
        if (cookies != null) {
            for (HttpServerCookie cookie : cookies) {
                if (HttpConstants.AUTHORIZATION.equals(cookie.getName())) {
                    authorizationValues = Collections.singletonList("Bearer " + cookie.getValue());
                    break;
                }
            }
        }
    }