The rest sensor with secret token?

This works:

#configuration.yaml
  - platform: rest
    name: The count
    resource: http://10.0.24.103:8000/api/fish/
    method: GET
    headers:
      Authorization: Token abcdefg
    value_template: "{{ value_json.count }}"
    scan_interval: 300

This does not:

#configuration.yaml
  - platform: rest
    name: The count
    resource: http://10.0.24.103:8000/api/fish/
    method: GET
    headers:
      Authorization: Token !secret app-id1_token
    value_template: "{{ value_json.count }}"
    scan_interval: 300

#secrets.yaml
app-id1_token: abcdefg

Anyone know why?

From docs this should work:

Authorization: !secret app-id1_token

#secrets.yaml
app-id1_token: Token abcdefg

But for me it does not either.