Allow access_token value in request header