Authorization header is used instead of query parameter for authenticating since the query parameter approach is insecure