Use header field for token submission instead of basic auth