fixed auth header