allow authentication using headers