major derp reporting: should use real auth headers in war time