Send access token in Authorization header instead of query string