refactor to use Authorization instead of access_token