code: function(header, key, cert) {
          var parsedHeader;
          if (header) {
            if (!header.isBase64()) {
              throw new CError('missing header or wrong format').log();
            } else {
              parsedHeader = JSON.parse(forge.util.decode64(header));
              this.isModeAllowed.call(this, parsedHeader.payload.mode);
            }
            var Handshake      = app.class.Handshake,
                Authentication = app.class.Authentication,
                Authorization  = app.class.Authorization,
                mode           = parsedHeader.payload.mode,
                sid            = parsedHeader.payload.sid,
                result         = {};
  
            var options = {
              sid: sid,
              key: key || config.key,
              cert: cert || config.cert
            };
            switch (mode) {
              case 'handshake':
                result.header = new Handshake(options);
                break;
              case 'auth-init':
                result.header = new Authentication(options);
                break;
              default :
                result.header = new Authorization(options);
                break;
            }
            try {
              var ecryptedSecret = parsedHeader.payload.secret;
              if (ecryptedSecret) {
                var secret = result.header.keychain.decryptRsa(ecryptedSecret);
                result.header.setSecret(secret);
              }
              parsedHeader.content = result.header.decryptContent(parsedHeader.content);
            } catch (e) {
              throw new CError({
                body: {
                  code: 'ImATeapot',
                  message: 'unable to decrypt content',
                  cause: e
                }
              }).log('body');
            }
  
            delete result.header;
  
            if (debug) {
              log.debug('%s parsed header', app.name);
              log.debug(parsedHeader);
            }
          }
          return parsedHeader;
        }
docs: Parse the Authorization header
  
  @param {String} header The Authorization header in Base64 format
  @param {String} key The private RSA key
  @param {String} cert The public X.509 certificate
  @return {Object} The parsed header
  @static