more precisely add HTTP Auth header