Header based oauth authentication