give explicit feedback when the client did a pre-request without authorization header