Check headers and body in auth request responses.