support authentication via headers