headers based authentication is in hex