missing mandatory x authorization request header