Set the authorization header even if it's not Basic Auth

Here's one more for you. I found that the HTTP_AUTHORIZATION header wasn't set on my apache server, and so requests for resources were failing with the message "The access token was not found".

This commit sets $headers['AUTHORIZATION'] in the request object even if the request isn't using HTTP basic auth.