Trying out header-based authorization