add the Authorization header to requests