Why don't we just use the `Authorization` header?