obscure auth header

all better