Now signs get request using Authorization header, but not with user tokens