auth_headers is in the cookie not the header