allow custom headers in authn