use HTTP header to pass Access-Token

```http
GET /api/users/profile HTTP/1.1
Host: localhost:3000
Access-Token: 4ebbcf209ca3625dfe0b2595d627ffacd90f8cefd69722712a451a7c291643af
```