update tests to use correct auth-token header