handle auth header