switch authentication to use header instead of access_token param