eventsource headers authorization