Authorization header is often treated specially by reverse proxies, IDS/IPS, firewalls, web caches, web servers, etc. in regard to information disclosure. The primary concern here is that headers may be logged or cached by intermediate systems if your architecture is more complex than just a single web server running over HTTPS.
If you're just running something simple like an Apache or nginx server with no special logging then I wouldn't consider using an alternative header to be a security issue. In such a setup it's no different to using
Cookie headers in terms of security.
In general if you have the option to pass sensitive data in a POST request instead of in a header, do so. POST bodies are almost never logged except in debugging scenarios. You also have the benefit of the browser's automatic prompts to avoid accidental resubmission of a form using the browsing history buttons (back, forward), whereas a GET with an authentication header will not trigger this mechanism.