fixed: support for authorization header (spec: 2.3.1)