No more NRE's when an incorrect auth header is passed