diff --git a/pkg/server/genericapiserver.go b/pkg/server/genericapiserver.go
index 38b5dab5d..2c19a0d28 100644
--- a/pkg/server/genericapiserver.go
+++ b/pkg/server/genericapiserver.go
@@ -388,9 +388,10 @@ func NewDefaultAPIGroupInfo(group string, registry *registered.APIRegistrationMa
 	return APIGroupInfo{
 		GroupMeta:                    *groupMeta,
 		VersionedResourcesStorageMap: map[string]map[string]rest.Storage{},
-		OptionsExternalVersion:       &registry.GroupOrDie("").GroupVersion,
-		Scheme:                       scheme,
-		ParameterCodec:               parameterCodec,
-		NegotiatedSerializer:         codecs,
+		// TODO unhardcode this.  It was hardcoded before, but we need to re-evaluate
+		OptionsExternalVersion: &schema.GroupVersion{Version: "v1"},
+		Scheme:                 scheme,
+		ParameterCodec:         parameterCodec,
+		NegotiatedSerializer:   codecs,
 	}
 }
diff --git a/pkg/server/options/authentication.go b/pkg/server/options/authentication.go
index aafaa3de8..16378fa14 100644
--- a/pkg/server/options/authentication.go
+++ b/pkg/server/options/authentication.go
@@ -60,7 +60,7 @@ func (s *RequestHeaderAuthenticationOptions) AddFlags(fs *pflag.FlagSet) {
 // ToAuthenticationRequestHeaderConfig returns a RequestHeaderConfig config object for these options
 // if necessary, nil otherwise.
 func (s *RequestHeaderAuthenticationOptions) ToAuthenticationRequestHeaderConfig() *authenticatorfactory.RequestHeaderConfig {
-	if len(s.UsernameHeaders) == 0 {
+	if len(s.UsernameHeaders) == 0 || (len(s.UsernameHeaders) == 1 && len(s.UsernameHeaders[0]) == 0) {
 		return nil
 	}