use http_authorization header with nginx