use header based authorization when getting user info