Token is now passed through headers instead of querystring param