only add auth header to requests to api. fixes #3