Allow setting the token via HTTP header

Quick summary: this is very useful for XHR requests where the request body is JSON instead of form encoded data.

For juicy details, see commit messages :)