bad request: missing required Authorization header