Pass ->headers so credentials are also passed (allowing for non-basic auth).  Also return the resposne so that the proper HTTP status code is propogated throught the call stack.