decode token in header.