remove the access token from API urls and put in Authorization header