Allow auth token via header