make tokens reset after each request, return new token in request headers