add authorization to header only if specified by user