moving token auth to headers