I was testing the output of HTTP headers using C4::Output::output_html_with_http_headers, and I was going crazy wondering why my headers weren't coming through on http://localhost:8081 And the reason is that authentication pages don't use this function! C4::Auth::checkauth and C4::Auth::get_template_and_user do their our outputs which leads to duplication.