checking secret auth header