accept auth token in x-auth headers instead of in the url.