auth header refactor [wip]
update tests to reflect use of dashes in headers