running this is a callback, instead of storing `headers`, to make sure that the current credentials are used.