authorization via http header for basic auth