Authentication is done in http header