get token from header