set user's secure token in request header