Authorization in header, fixes #6