Is there any interest in header based client authentication instead of after the websocket is opened (NIP-42)?

I understand other use cases where it happens later in the flow, but why not both?