Use merge rather than update to avoid mutation

There's no need to mutate the auth headers in place since they're being
set to a new variable `preferences`.