auth supports HEAD now