Fix two issues found testing curl command

1. quote the Authorization header
2. avoid harmful leading & in request body