incude Authorization in the allowed headers