change order of authorizations and add header for http-auth