Send authorization via headers instead of parameter