don't use changeable header to hold authenticated user name.
Instead use req.user - same as Express.js basic auth.