pass token as body in post request