Using authorization in headers for api