Testing that auth headers still added to derived resource objects