This one isn't too hard, it's here to make you think about how you might want to use baggage.
Baggage items get propagated as HTTP headers, and this app uses the W3C baggage format.
Setting the right header will let you bypass the authorization check.
Need more? Here's the solution.