expose authorization header
refactor code to prevent NPE