Fix `verifyHeaderToken` and provide test