HTTP Authorization header instead of custom header