authorization token is passed as a header, the others are passed as params