options.headers might be a simple object or iniated with the Headers API. Copying an object of type Headers using spread syntax will not copy the key-values stored within the object.
As auth.fetch is a wrapper for the Fetch API, we might expect people to use the Headers API to initiate headers that are passed through the options parameter.
I have created a branch that aims to fix this, but struggle a bit with the tests, so need some help.