If I don't specify the auth token, it still sends an "Authorization" header, which the server sees as incorrect syntax.