Auth by headers.