empty passwords should be allowed
Remove duplicated header issues

Headers were getting duped back into client config, causing invalid
requests to be sent out
remove debugging aid
Add spec to ensure auth is sane