use OAuth2 Authorization header so it works with non-GET requests too