rest: deprecate bootserver auth without header
Authorization: Bootserver