preliminary work on custom http headers for authentication tokens