Be more flexible with header authorization by searching for 22 character token.
User - Bomb 1-n reference.
Restrict Bomb access to authenticated User.