make sure authorization header is replaced