update request headers, add generate auth token