adding auth token header