new header_loader to support login via Auth header, if header exists, instead of via cookie