use auth headers for oauth token auth

auth auth auth