removed auth header from response.