title: Is it okay to embed username in BEARER Authorization Header?
body: <p>I have an API endpoint created using Web API to create a security Token. So the user passes username:password in a Basic Authorization header. The username/password is verified and a Json Web Token is returned.</p>
  <p>Now all my other endpoints that do GETs or POSTs I will pass in the JWT in the Authorization header as a BEARER type. I know typically this is BEARER + (jwt) but would it be just as okay to pass
  BEARER + username:(jwt)</p>
  <p>The reason I want to pass the username:(jwt) is when I verify the jwt I also want to pull out the username from the jwt claim and compare it to the username passed in the auth header as an extra check.</p>
  <p>Does this approach sound good or should I forget about doing the username check altogether because it doesn't add any extra security?</p>