If you have the auth in the URL, do you also want it in the headers?

I just realized that this is your expected value that you are comparing to ... so probably you do want it here.