make auth work with the header