complete draft of auth header substitution for api testing