bearer token authorization with HTTPS transport

Hi, I would like to be able to serve a git repository over HTTPS from a web server that requires OAuth2-style bearer tokens for authorization. For more context, see this thread: https://groups.google.com/forum/#!topic/sandstorm-dev/4oigfb4-9E4

Does anyone here have any advice about how to convince a git client to add an "Authorization: Bearer <token>" header?

I can think of a few approaches:

(1) I could modify the curl remote helper to insert the header if it sees a "bearertoken" config option. I have in fact written a proof-of-concept patch that does this (see https://github.com/dwrensha/git/commit/4da7b64b85b3b6652abe7), but I don't know how much of chance something like this has of getting merged into the mainline git client.

(2) I could write a new remote helper for, say, a "https+bearertoken" transport. This seems like it would be more work than (1), but it would also allow easier installation without interfering with the rest of git.

(3) I could write a proxy server that inserts the header, designed to run on the same machine as the client. This feels rather heavyweight.

Am I missing anything?

Thanks, David