indie auth in header