Only pass auth header through, as all of them cause 500 errors from GAE