Add is from header validation for rest auth