fwr: should pass base64-encoded service token