Token now is in Authentication header