implement api authentication via headers (rather than params)