In which request header is a token usually sent?
X-Requested-With
Authentication
Access-Control-Allow-Origin
Authorization