Protect Yo callback with Auth-Token header.