send back token as header