Steps to reproduce:

1. create js-file with following content(replace api-key and hostid with enviroment related ones):

try {
    var req = new HttpRequest();
    var Query = {"jsonrpc": "2.0","method": "host.get","params":

{"output": "extend","hostids":"16328"}

,"id": 1};
    var authToken = "1234567890";
    req.addHeader('Content-Type: application/json');
    req.addHeader('Authorization: Bearer' + authToken);
    reqq = request.post("https://zabbix.api.endpoint/zabbix/api_jsonrpc.php", JSON.stringify(Query));
    var data = JSON.parse(reqq);
    return JSON.stringify(data)
} catch (error)

{     Zabbix.Log(3, "Error message 'warning': "+error);     return ""; }

Run that js like: zabbix_js -s myfile.js -i myfile.js

If query contains old-style "auth":"1234567890" and there's no authorization header, everything works ok.

Result:

{"jsonrpc":"2.0","error":\{"code":-32602,"message":"Invalid params.","data":"Not authorized."}

,"id":1}

Expected:
Host data