adding Authorization headers to all APIs