Fix auth bouncer requests

They should always be `GET` (for now, at least) and should exclude extraneous headers.