rename X-SECURE-TOKEN to HTTP_X_SECURE_TOKEN