don't use arbitrary order when creating Authorization header