Fix #295, url params getting added to the authorization header