Parse bearer tokens out of the Authorization header

It's more proper. Query string parameter is still supported, of course. Add
Authorization to CORS, but it'll still cost a preflight. But, you know, if you
want to, it's there.

Either way, I need to tweak nginx to not log the darn things.
Don't cache anything
Send a Cache-Control no-store on the client too

Per draft-ietf-oauth-v2-bearer recommendation.