fix auth header, improve invalid token exception