fix auth request Content-Type header

When json: true is specified, request adds Content-Type: application/json which results in a 400 response. This workaround removes json:true and manually parses the response body instead.