customer login + add Authorization in request header