additional authorisation header field