add auth headers to ajaxSetup so it's set only once.
just set the token variable once.