Moved X-REMOTEAUTHID header injection before /me/ is fetched