support authentication token in header