adds Authorization header when user_info included in URI