authorization header must be specified.