Move authentication flow to server-side

 * Send oauth token in header for all API requests