extract auth header updates
signin/redirect logic to currentUserController

registrations is reusing this now