Test is_authorized path
Set User header in the response.