add x-authorization-header support