Authorization header is allowed