Using an http-header instead of a parameter for token
Making the access_token column in api_keys unique