Still add the first token as a OAuth2 header for backwards compatibility