Validate custom headers
Don't do custom auth stuff in interact

Header's ignored and this is managed elsewhere (and tested).  Might even
work.