Also allow token auth header