Use token auth
Add respond_with_header matcher
Include X-User-Token in authenticated responses