api: accept token from headers too