headers, media
merge
crazy header auth. still not working