add the missing header on /signin

fixes #389