Allow auth headers to be set without login.

This enables clients to use existing auth tokens.