add X-PP-AUTHORIZATION header