The data connector configuration page currently does not allow variables to be referenced by HTTP header values. One reason to add this is to create a uniform way of sharing 3rd party identifiers as headers, rather than in the request URL or in the request body. Moving the user identifiers to the headers means they are obfuscated by HTTPS and thus more secure to MITM vulnerabilities.
Allowing this in HTTP Authenticator configuration would improve this further by allowing the transfer of user identity metadata to issuing authorities, allowing the issuer to use the information to add identifier metadata directly into the issued JWT, providing a very secure mechanism for trusted identification of particular user identity for the downstream service.