fixed authentication header