fix missing auth header on markAllRead