correct HTTP header from Authentication to Authorization