authentication using headers