aaronpkI was messing with nginx auth config and added the SSO proxy to the chat logs. there was a bug in the auth module that rejected the request if it had an invalid authorization header, whereas it was supposed to pass it through just without setting the auth_user
