Use authorization header explicitly.