Move from Basic auth to token authentication

Since Pivotal Tracker obviously cannot use Basic authentication in
Activity Webhook, the other way to authenticate the POST requests is to
include a token query parameter.

This patch makes the receiver check for a token instead of Basic auth
username and password.