public function behaviors()
{
    $behaviors = parent::behaviors();

    $auth = $behaviors['authenticator'] = [
        'class' => HttpBearerAuth::className(),
        'only' => ['can-access'],
    ];
    $behaviors['access'] = [    //This fails
        'class' => AccessControl::className(),
        'only' => ['can-access'],
        'rules' => [
            [
                'actions' => ['can-access'],
                'allow' => true,
                'roles' => ['@'],
            ],
        ],
    ];
    $behaviors['contentNegotiator'] = [
        'class' => ContentNegotiator::className(),
        'formats' => [
            'application/json' => Response::FORMAT_JSON,
        ],
    ];

    ];


    $behaviors['authenticator']['except'] = ['options'];
    return $behaviors;
}

public function actionCanAccess()
{
    echo $access = Yii::$app->user->isGuest;  //this returns false

}