note on headers for authentication