send authorization headers instead of url params