concat access token if it's sent as multi-value headers