Also check here for token_header?

      if token = read_secure_token && token_header.present?