arguments to auth_headers() needed to be swapped here.