fix url and auth headers