only update auth headers if they are present in response
readme [wip]