Fetch X-Spree-Token in request.headers

As that is where it's available rather than in request.headers.env which
would bring the full header env name e.g. HTTP_X_SPREE_TOKEN

Fixes #3798