How to send token via header not in the url parameters?

Hi, in our application, for login, we use User plugin. Everytime when user wants to access the application, user has to type own username and password (in the server side it generates token, then it access via token). However, now, we need open a certain page without displaying the login page. We did it using the User plugin’s public attribute and giving access token via url. However, for security reason, we have to send token via Header not with URL. Could you give any suggestions?
Our main goal is to open certain page without displaying login page by sending token securely.