move token from url to headers