first test for authorization
does not authorize bad password
extracted a RequestHeader class
introduce field