give precedence to a `X-Token` header over the `token` JSON payload