add header authentication and render_unauthorised