The authorization token here is not a cookie. [RFC-7235][1], which defines the Authorization header, states that:

> The HTTP authentication framework does not define a single mechanism
   for maintaining the confidentiality of credentials; instead, each
   authentication scheme defines how the credentials are encoded prior
   to transmission.  

So it depends on the specification of Bearer, which is [RFC-6750][2]. It states:

> TLS is mandatory to implement and use with this specification.

Which tells me that it should be possible to retrieve it and more importantly, not using TLS here is a vulnurability.


  [1]: https://tools.ietf.org/html/rfc7235#section-6.1
  [2]: https://tools.ietf.org/html/rfc6750#section-1