Now authorizes by checking HTTP header & session data (in that order)