Access token is now sent in the authorization header