fixed token authentication

allow user to provide `auth.type='token'` and correctly encode the token for **authroization** header