Use the X-Auth-Token header