backward-incompatible changes to types, parse signatures, and authorization header