authentication uses bearer token headers