fix users session spec
pass private token using HTTP headers