hacking bearer with custom auth header