move authorization method to api class and enable request limiter header data