This isn't clear. How do you set the `username` and `token` "headers"? Are these query parameters? Where does someone get their token from?

Showing a full request (HTTP headers and all) would be helpful.