when we get the auth headers, we still need to read out the full body response

as otherwise we can re-send requests on the same connection nicely