read the auth token form the X-AUTH-TOKEN header and not from the body