Authorization header parsing, Session resource creation