rewrite rules for f3 and http authorization header