Laravel 5.3 cannot find "Authorization" header?!

I'm making a jQuery $.get request. I have $.ajaxSetup like so:

    $.ajaxSetup({
        headers: {
          'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content'),
          'Accept': 'application/json',
          'Authorization': 'Bearer ' + '0123456789012345'
        }
    });

When the XHR request happens, the Authorization header is there according to Google Chrome Dev Tools.

However, if I dd() this in \Illuminate\Http\Request at line 827 like so:

    public function bearerToken()
    {
        $header = $this->header('Authorization', '');

        dd(__METHOD__ . ':' . __LINE__, $header);

        if (Str::startsWith($header, 'Bearer ')) {
            return Str::substr($header, 7);
        }
    }

I get this:

"Illuminate\Http\Request::bearerToken:829"
""

That "" is the empty header string. That is, there's no Authorization header.

And doing dd on $this->headers gives the header bag without the Authorization header in it. That is, it's completely lost.

I've also tried adding the header to the $.ajaxSetup with a beforeSend function that adds the header like so:

    $.ajaxSetup.beforeSend = function(xhr){
        xhr.setRequestHeader('Authorization', 'Bearer ' + '0123456789012345');
    };

And, again, it appears in Chrome Dev Tools.

I've also tried sending an arbitrary header, like foo, and that appears in the header bag no problem.

'0123456789012345' is set in my users table api_token column, and I'm using the right user. I'm appending the string directly just for testing.

Here's my test route:

+--------+-----------+-----------------------+-------+------------------------------------------------+--------------+
| Domain | Method   | URI                  | Name | Action                                            | Middleware   |
+--------+----------+----------------------+------+---------------------------------------------------+--------------+
|        | GET|HEAD | api/reports/{report} |      | App\Http\Controllers\Api\ReportsController@report | api,auth:api |

What's happening?