The httpbin check sends `$NVM_AUTH_HEADER` to `http://127.0.0.1/bearer` without configuring a mirror.
Set `$NVM_NODEJS_ORG_MIRROR` to that host,
as a real user of the header would,
so the check keeps exercising the header once it is only sent to URLs under a mirror
Discovered by Anthropic's OSS Scanner, as ANT-2026-YPW87EDH; the scanner reported it as a vulnerability, but it is not one.