Takes and returns a roUrlTransfer object after adding a Jellyfin "Authorization" header

Returns a string containing the "Authorization" header payload.

DeviceId is the one field here that is load-bearing for session identity: Jellyfin resolves it from THIS header only (never from a query string), and falls back to the DeviceId the auth token was minted under when the header omits it. Every channel that opens a Jellyfin session must therefore send this header, or it silently lands on a different session — see the ws:// receiver in RemoteControlTask and issue #743.

written as a raw string with no header-encoding layer, and a user-set Roku name may carry non-ASCII; the server already holds the device name on the token's device row, and omitting it also avoids a device-row rewrite on every reconnect. HTTP callers keep the default.

Functions for making requests to the API

Shared HTTP execution for the API task tiers. Builds the request args (auth header, timeout, Content-Type default) from a request AA and performs the roku-requests call. Returns the raw roku-requests result object, or invalid when the URL is missing/empty (the caller decides how to surface that — Tier 1 maps it to an error response AA, the fire-and-forget SideEffectTask ignores it).

Centralizes what previously lived duplicated in ApiTask.executeRequest() and SideEffectTask.executeSideEffect(); that copy drifted across three separate historical fixes (Content-Type default, URL validation, timeout centralization), each of which had to patch both copies in lockstep. Runs on whichever Task thread invokes it — free functions share the caller's m, so auth/global reads resolve exactly as before.

sets the certificate authority by file path on the passed node