Given the Auth interface, should clientAuth.headers be added to auth.headers as well? You can imagine an implementation that uses a custom header to provide the token, as well as something that uses a token/bearer header like we already support for basic auth.

(see also the others)