weak authorization via custom header