It turns out that it’s because I didn’t drink enough coffee when I wrote this code.
I forgot to set the mutated response to a variable.
Inside my if statement it should be:
$response = new Response(); $response = $response->withHeader('Location', '/auth')->withStatus(302);
The "$response =" in the second line is the part I missed.
Hope this helps others.