moving token auth into headers