Use request.headers to send auth_token instead of params hash