add authorization header