Extract access token for a DPoP-protected requests.
DPoP headers must be already validated by this point.