fix bug in authentication header