fix route
oauth with authorization header ok