actually set token to header