fix(auth): prioritize first auth header