Move token to a header instead of parameter, and if available, provide it for every request, whether needed or not