move shared secret to authorization header (bug 870976)