Function authSpendHeaders

Headers the object should add to a charged response.

Exported so the object's hunk calls this rather than formatting the same three headers itself; one codec, two callers, no drift.