fixed to correctly pass Authorization header.