now send x-auth-formtoken, according to new protocol