FIX: missing global for "RecentlyViewed" auth header on shelf

Moved aToken and qToken too purely for readability
FIX: added missing auth token to urls for Channels when skin in "Plex" mode

when using Quartz skin in Plex mode the "Channels" menu sub items where
missing their auth tokens being passed to GetXML thus resulting in a 403