Add an authorization header as XSS