a better model for the auth header dance