add authentication via http header token