change authentication to header instead of param