stripped out token and username from headers(should probably use in
decorator)