2673: Move auth to headers, avoid combining request body with GET method.