pushing even to a private registry needs at least a dummy auth header value