fix reading auth header
final bits to get security working.