Support access and refresh tokens in header

Support access and refresh tokens in header (Reference: comment on #8)