further do we need to be explicit on what the header should be or leave the responsibility on the authz module to set its headers (as we currently do for AuthModule)

see [applyAuthToken]