do not assume that just because we have an authorization header it will mean that we will gain access, always copy the request body in case we have to re-POST; allow a nil session; set Authorization header instead of adding to any existing ones