only add the auth header if we're not currently authenticating