optional headers for authentication