Allow authentication with X-API-TOKEN headder