moved token to header