support login with Authorization header