fixed token auth and inside header