fixed up order of checks. Added check for Authorization header.