Missing/wrong 'token' headers