- pass authentication token in request header instead of query parameters