get authentication from request headers