set correct authentication header when not logged in