is there a reason for adding `'host': api.oidcHost` to every call? can't we assume it's used in every request and add it to `_get_endpoint`?