update session headers with authorization key