Pass $request->headers so credentials are also passed (allowing for non-basic
auth).  Also return the resposne so that the proper HTTP status code is
propogated throught the call stack.