return headers with access_token