delegate authentication to login provider if authorization header set but empty, leads to infinite loop otherwise