Fixed issue where request params were being copied to the Authorization header.
Reverted test to remove incorrect strings, but left order be flexible.