auth header working, need to validate