js_client: wip: token headers