Use token header also for authenticated requests