Application password header not checked in REST API

Application password header not checked in REST API