setting header authorization