allow authentication key to be located in header