look in request.headers.env for api token