headers are overwritten by authorization code

[fehguy]

Conceptually, if you have a parameter in an operation of type header which has the same key name as provided by any authorization implementation, it should not be clobbered.

For example, you may have a field Authorizations to store a base-64-encoded value. But if you have added password auth, which applies the header Authorization the value supplied in the parameter should be sent to the server.