Allow additional headers when doing access-token requests