token is returned directly as an authorization header