fixed headers that were sent when user/password was not set