Use headers instead of auth