more auth fixes

no echoes, location in header