Authorization header support instead of Session-Id header for authorization