If a site is private, add authtoken headers