token endpoint; better accept header