authentication: sending bearer token in authorization header