fix: throw a better error if we don't get an authorization header for security confirmation

fix: throw a better error if we don't get an authorization header for security confirmation #19873