added Authorization allowed header. thanks to @nmathon