ensure secure token set for all API requests, and unset after each request