better handle missing auth header, set explicit response types to not get warnings...