Allowed Authorization header on all the endpoints