fix token insertion in request header + unit test