It's probably due to .UseHttpsRedirection() - service discovery calls on http and on redirect to https auth headers are removed.