added Authorization header to getSpreadsheet call

as per http://code.google.com/p/google-api-javascript-client/wiki/CORS