fixed bug in auth that prevented auth headers being accepted