#toosmall: added header for auth and not auth