diff --git a/contrib/pkg/client/auth.go b/contrib/pkg/client/auth.go
deleted file mode 100644
index ce129fae4..000000000
--- a/contrib/pkg/client/auth.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package client
-
-import (
-	"encoding/base64"
-	"fmt"
-	"net/http"
-)
-
-func addAuthHeader(r *http.Request, username, password string) {
-	usernameAndPassword := fmt.Sprintf("%s:%s", username, password)
-	b64UsernameAndPassword := base64.StdEncoding.EncodeToString(
-		[]byte(usernameAndPassword),
-	)
-	r.Header.Add(
-		"Authorization",
-		fmt.Sprintf("Basic %s", b64UsernameAndPassword),
-	)
-}
diff --git a/contrib/pkg/client/bind.go b/contrib/pkg/client/bind.go
index 503ebb67c..a0b2a94e7 100644
--- a/contrib/pkg/client/bind.go
+++ b/contrib/pkg/client/bind.go
@@ -1,7 +1,6 @@
 package client
 
 import (
-	"bytes"
 	"fmt"
 	"io/ioutil"
 	"net/http"
@@ -33,16 +32,9 @@ func Bind(
 	if err != nil {
 		return "", nil, fmt.Errorf("error encoding request body: %s", err)
 	}
-	req, err := http.NewRequest(
-		http.MethodPut,
-		url,
-		bytes.NewBuffer(json),
-	)
+	req, err := newRequest(http.MethodPut, url, username, password, json)
 	if err != nil {
-		return "", nil, fmt.Errorf("error building request: %s", err)
-	}
-	if username != "" || password != "" {
-		addAuthHeader(req, username, password)
+		return "", nil, err
 	}
 	httpClient := &http.Client{}
 	resp, err := httpClient.Do(req)
diff --git a/contrib/pkg/client/catalog.go b/contrib/pkg/client/catalog.go
index 54d1b180e..9ae9251f6 100644
--- a/contrib/pkg/client/catalog.go
+++ b/contrib/pkg/client/catalog.go
@@ -17,12 +17,9 @@ func GetCatalog(
 	password string,
 ) (service.Catalog, error) {
 	url := fmt.Sprintf("%s/v2/catalog", getBaseURL(host, port))
-	req, err := http.NewRequest(http.MethodGet, url, nil)
+	req, err := newRequest(http.MethodGet, url, username, password, nil)
 	if err != nil {
-		return nil, fmt.Errorf("error building request: %s", err)
-	}
-	if username != "" || password != "" {
-		addAuthHeader(req, username, password)
+		return nil, err
 	}
 	httpClient := &http.Client{}
 	resp, err := httpClient.Do(req)
diff --git a/contrib/pkg/client/common.go b/contrib/pkg/client/common.go
index 2f4fda8a6..53f92bbbd 100644
--- a/contrib/pkg/client/common.go
+++ b/contrib/pkg/client/common.go
@@ -1,7 +1,29 @@
 package client
 
-import "fmt"
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+)
 
 func getBaseURL(host string, port int) string {
 	return fmt.Sprintf("http://%s:%d", host, port)
 }
+
+func newRequest(
+	method string,
+	url string,
+	username string,
+	password string,
+	body []byte,
+) (*http.Request, error) {
+	req, err := http.NewRequest(method, url, bytes.NewBuffer(body))
+	if err != nil {
+		return nil, fmt.Errorf("error building request: %s", err)
+	}
+	if username != "" || password != "" {
+		req.SetBasicAuth(username, password)
+	}
+	req.Header.Add("X-Broker-API-Version", "2.13")
+	return req, nil
+}
diff --git a/contrib/pkg/client/deprovision.go b/contrib/pkg/client/deprovision.go
index 0c874037d..0098f7cfc 100644
--- a/contrib/pkg/client/deprovision.go
+++ b/contrib/pkg/client/deprovision.go
@@ -18,16 +18,9 @@ func Deprovision(
 		getBaseURL(host, port),
 		instanceID,
 	)
-	req, err := http.NewRequest(
-		http.MethodDelete,
-		url,
-		nil,
-	)
+	req, err := newRequest(http.MethodDelete, url, username, password, nil)
 	if err != nil {
-		return fmt.Errorf("error building request: %s", err)
-	}
-	if username != "" || password != "" {
-		addAuthHeader(req, username, password)
+		return err
 	}
 	q := req.URL.Query()
 	q.Add("accepts_incomplete", "true")
diff --git a/contrib/pkg/client/poll.go b/contrib/pkg/client/poll.go
index ba1c57554..79f0c9f88 100644
--- a/contrib/pkg/client/poll.go
+++ b/contrib/pkg/client/poll.go
@@ -24,16 +24,9 @@ func Poll(
 		getBaseURL(host, port),
 		instanceID,
 	)
-	req, err := http.NewRequest(
-		http.MethodGet,
-		url,
-		nil,
-	)
+	req, err := newRequest(http.MethodGet, url, username, password, nil)
 	if err != nil {
-		return "", fmt.Errorf("error building request: %s", err)
-	}
-	if username != "" || password != "" {
-		addAuthHeader(req, username, password)
+		return "", err
 	}
 	q := req.URL.Query()
 	q.Add("operation", operation)
diff --git a/contrib/pkg/client/provision.go b/contrib/pkg/client/provision.go
index 5f010dce6..c082ce436 100644
--- a/contrib/pkg/client/provision.go
+++ b/contrib/pkg/client/provision.go
@@ -1,7 +1,6 @@
 package client
 
 import (
-	"bytes"
 	"fmt"
 	"net/http"
 
@@ -36,16 +35,9 @@ func Provision(
 	if err != nil {
 		return "", fmt.Errorf("error encoding request body: %s", err)
 	}
-	req, err := http.NewRequest(
-		http.MethodPut,
-		url,
-		bytes.NewBuffer(json),
-	)
+	req, err := newRequest(http.MethodPut, url, username, password, json)
 	if err != nil {
-		return "", fmt.Errorf("error building request: %s", err)
-	}
-	if username != "" || password != "" {
-		addAuthHeader(req, username, password)
+		return "", err
 	}
 	q := req.URL.Query()
 	q.Add("accepts_incomplete", "true")
diff --git a/contrib/pkg/client/unbind.go b/contrib/pkg/client/unbind.go
index f6d92f1a8..0dc73e88a 100644
--- a/contrib/pkg/client/unbind.go
+++ b/contrib/pkg/client/unbind.go
@@ -20,16 +20,9 @@ func Unbind(
 		instanceID,
 		bindingID,
 	)
-	req, err := http.NewRequest(
-		http.MethodDelete,
-		url,
-		nil,
-	)
+	req, err := newRequest(http.MethodDelete, url, username, password, nil)
 	if err != nil {
-		return fmt.Errorf("error building request: %s", err)
-	}
-	if username != "" || password != "" {
-		addAuthHeader(req, username, password)
+		return err
 	}
 	httpClient := &http.Client{}
 	resp, err := httpClient.Do(req)
diff --git a/contrib/pkg/client/update.go b/contrib/pkg/client/update.go
index 6dcf88786..8689dfe67 100644
--- a/contrib/pkg/client/update.go
+++ b/contrib/pkg/client/update.go
@@ -1,7 +1,6 @@
 package client
 
 import (
-	"bytes"
 	"fmt"
 	"net/http"
 
@@ -33,16 +32,9 @@ func Update(
 	if err != nil {
 		return fmt.Errorf("error encoding request body: %s", err)
 	}
-	req, err := http.NewRequest(
-		http.MethodPatch,
-		url,
-		bytes.NewBuffer(json),
-	)
+	req, err := newRequest(http.MethodPatch, url, username, password, json)
 	if err != nil {
-		return fmt.Errorf("error building request: %s", err)
-	}
-	if username != "" || password != "" {
-		addAuthHeader(req, username, password)
+		return err
 	}
 	q := req.URL.Query()
 	q.Add("accepts_incomplete", "true")