Apache strips down “Authorization” header

This has been asked before, but. I'm trying to implement JWT token auth with PHP 7 on apache 2.4. The script (symfony) never sees the Authorization header.

I've read Apache strips down "Authorization" header and already added:

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

to no avail. mod_rewrite is enabled and php loaded as module.

My simple test case is

curl --header "Authorization: Bearer eyJ0....." http://localhost/test.php

I'm totally lost as to what else could potentially be needed to get the Authorization header into php?