dropped auth header in favour of more general headers array