allowing custom header for authentication request