verify AUTHORIZATION header works
allow for header key 'Authorization'