Check Authorization header in /authorized request