Comment on http_authorizaion header