Adding checks for HTTP Authorization headers

API consumers outside the webapp will be using HTTP headers to present the OAuth token, so we should check for one. This probably belongs in a more central place that spans all HTTP verbs..