set Authorization header, avoid blinking