send auth in data when possible, in header otherwise