Move auth from cookies to x-scramble-* headers