Use Bearer authorization header

Authorization: Token token="..." has been removed from OAuth 2.0 draft
in v10, and later drafts and RFC version uses Bearer token header.