* always send client auth headers