change authentication token to authorization token & add token exchange for customer credentials