setting token always as 'bearer'