post with auth header