Check token in header. Part of #44