Auth-Token header doesn't work on TODO APP

curl -v -H "Accept: application/json" -H "Content-type: application/json" -X POST http://localhost:8080/aerogear-controller-demo/login -d '{"username":"john","password":"123"}'

curl -v -H "Accept: application/json" -H "Content-type: application/json" --header "Auth-Token: [YOUR TOKEN]" -X GET http://localhost:8080/aerogear-controller-demo/auth/otp/secret