rename X-SECURE-TOKEN to SECURE-TOKEN