I don't think you will be able to accomplish what you are trying to do
using authorization  headers because I don't think the request  headers
are mutable from within a servlet. The headers are supposed to be
supplied by the client. Thus, you will have to prompt your client for
authorization. Is this a problem?

Why do you need the Authorization header  anyhow? Is it a requirement
from jsp:smart when the file  is going to end up in a protected
directory?