alright... I think I realized the problem; my oathkeeper.yml

check_session_url

was still defaulted to

kratos

, but that service is running as a different name. ✅ -- not sure if authed, but I'm not hitting the service. checking headers comes next.