don't send impersonated principals accessToken in header