making client auth check params before header