do shared secret via Authorization header (bug 891077)