Merge commit from fork

getToken() called decodeURIComponent() on the Authorization Bearer value
outside any error handling, so a request with a malformed percent-encoded
token (e.g. `Authorization: Bearer %`) threw an uncaught URIError to the
caller. Treat malformed encodings as an invalid token and return null,
matching how undecodable tokens are already handled.

Fixes GHSA-xmf8-cvqr-rfgj