correctly send auth token in http header