fixed to use custom header to basic authorizaton