add x-auth-token to locals