comment out a deprecated configuration
extracts authorization header handling to methods