do not pass auth header