add x-auth-token header with hope that everything still works tomorrow