handle authentication via HTTP_HEADERS