Pull access token from header instead of keychain