fix duplicate authorization header