all `auth_tokens` will be passed as GET requests in the header now