asap: authorization header missing