also check headers for auth_token
disable credit check during transition