setting content-type to application/json breaks authentication on POST requests