Move from Basic auth to token authentication

It is simpler to use a query parameter than to set up Basic auth on
proxies and configure them to forward the Authorization header.