authorization headers sent with API requests