notes about Authorization header, as php-fpm doesn't support getallheaders() yet, however NGINX still passes the header!