Authentication uses HTTP headers