check for masquerade header before authorization