clarify authorization header