An NGINX auth_request chain works for browsers and fails for API clients

The edge authorizes the request, yet the application denies it because the auth subrequest flow discarded the header the backend policy still uses.