Use current principal if provided for auth
Only set authorization header if none provided