fix: properly attach auth headers after login