now using the authorization header rather than put the http basic auth string inside the url