tweak Authorization header 4 authenticated request