put the token in the header so it won't appear in accesslogs