The package also saves the `Authorization` token in the cookies, and `fastapi.security` classes expect the token to be only in the headers.