just sent in as the auth header token