Turns out this works just fine and was the correct setup to do this.
My issue is actually with the header not being sent because my login navigation was a redirect.