fixed authenticate. spits out the good header for auth