generalize the auth function to return any headers, not just a token