Feature: Add api-token to the allow headers