individual calls can have

@Header("Authorization")

parameters. I think you should be able to pass a User object there, and register a converter from User to header string, and have it all work out? haven't actually tried that though