bugfix: missing Authorization header