token header has been extracted to token.cc