update token for each xhr request