add x-auth-token header