merge headers object to request; test normal methods in unauthenticate context