For some reason Apache 2.4 (and maybe earlier versions, but nobody should care about them) drop the Auth header. No idea why, but here’s the solution:
RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]