Security - user credentials retrieved from request header