authentication working, sending headers back to front end