test auth (initial)
add auth header (simplified)