Fix auth bouncer response handling

We incorrectly assume the bouncer response will contain the `X-Owner-Id` header in all cases.