does it make sense to treat $auth specifically? could we just inject a list of custom headers? might be useful for other things too.