v2 Security: Implement authToken HTTP headers instead of query string