update header to use auth