Move auth token to headers